The Failure of Static Tokens

Giving an AI agent a static 'god token' is a recipe for catastrophic failure. In one instance, an agent tasked with cleaning up workloads accidentally deleted 200 production jobs in 90 seconds because a filter evaluated to null. The agent wasn't being malicious; it was simply executing its instructions within the bounds of its overly permissive token.

Treating agent permissions as a boolean (you either have the scope or you don't) is insufficient. Narrowing the scope is often a temporary fix that leads to the agent becoming useless or the human having to manually perform the tasks anyway. Instead, agents should be managed through budgets—a multi-dimensional approach that defines how much they can do, how fast, what they can undo, and who is monitoring them.

Four Primitives for Agent Governance

To safely scale agentic workflows, implement these four enforcement primitives:

• Asymmetric Verbs: Categorize operations based on failure modes. Give agents access to verbs that 'fail out loud' (e.g., unskipping a test, which causes a visible red build). Keep humans in the loop for verbs that 'fail silently' (e.g., skipping a test, which can hide production bugs).
• Rate Limits (Ceilings that Refill): Every write operation must have a rate limit. This provides a hard ceiling on how much damage a single loop can cause. By making these limits refillable, you eliminate the need for manual ticket filing for quota increases.
• Trip Wires over Allow Lists: Allow lists are static guesses made upfront. Trip wires are dynamic, data-driven monitors. By tracking aggregate behavior (e.g., number of investigation threads launched per hour), you can detect systemic issues and adjust agent prompts to improve behavior over time.
• The Undo Test: Before granting an agent a capability, ask: 'Can the agent undo this itself?' and 'How bad is the impact if it gets it wrong?' If the answer to either is 'no,' the agent must not hold the key; a human must provide the second key for the operation.

Infrastructure and Identity

Policy enforcement must exist in two layers: text (prompts/markdown) and infrastructure (proxy layers). Prompts explain the 'why' and guide intent, but they are not enforceable. Infrastructure (like an admission webhook) provides the hard, deterministic boundaries that cannot be bypassed by prompt injection.

Crucially, identity must be stamped by a proxy, not the agent itself. If an agent can claim its own identity, it can simply rotate headers to reset its rate limits. A proxy ensures that every action is tied to a specific, immutable identity, allowing for auditability and consistent enforcement of quotas across all agent sessions.