> Markdown version of [/events/world-congress-2026-north-america/sessions/1695-give-the-agent-a](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1695-give-the-agent-a). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Give the Agent a Budget, Not a Token


- **Event:** World Congress 2026 North America

## Description

Every agent demo runs with a god-token. Then it ships, and someone has to explain why the helpful AI just rm -rf'd the staging database "to clean up."

I run platform infrastructure at a frontier lab, and for the last year my job has partly been: let coding agents do real work against real systems, without ever having to write the postmortem. This talk is the permission model that fell out of that - not RBAC-with-extra-steps, but primitives designed for an actor that's smart, fast, tireless, and occasionally *confidently wrong*.

**The four primitives:**

- **Asymmetric verbs** - the agent can `quarantine` but not `delete`, `retry` but not `approve`, `propose` but not `merge`. The verb list *is* the security boundary. Stop thinking in resources, start thinking in reversible vs. irreversible actions.
- **Regenerating budgets** - every agent identity gets N disruptive actions per window. Burn the budget, you're benched until it refills. No human-in-the-loop until the budget's gone — which means 95% autonomy with a hard ceiling on blast radius.
- **The undo test** - if the agent can't undo it, the agent can't do it without a second key. One line, surprisingly load-bearing.
- **Tripwires over allow-lists** - let the agent roam, but instrument the three actions that would actually hurt. Cheaper than enumerating everything safe.

I'll show the ~200-line policy layer that implements all four, the failure modes each one exists to catch, and the one design I shipped that turned out to be security theater. Tool-agnostic - works whether your agent is touching CI, a database, a cloud account, or your users' files.

If you're shipping an agent that does anything more than read, you'll leave with a threat model and a starting policy you can paste into your repo on the flight home.

## Speaker

### [Sachin Malhotra](https://www.wearedevelopers.com/@sachin-malhotra)

MTS @Anthropic


## Related talks at this congress

- [Your Evals Passed. Your Agent Just Emptied a Database.](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1684-your-evals-passed) — Tejas Pravinbhai Patel
- [When Agents Became Users: Rearchitecting Identity and Permissions for AI at Scale](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1713-when-agents-became) — Yoav Gal, Dor Cohen
- [Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1432-securing-ai-agent) — Abdel Fane
- [Agents Can't Iterate Against Tests That Lie](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1700-agents-can-t-iterate) — Rocky Warren

## Watch remotely

Can’t make it to San José? Watch this session live with Pro. You also get:

- All full videos, bookmarks, and playlists
- World Congress livestreams

[See pricing](https://www.wearedevelopers.com/pricing)

## Links

- [Get tickets](https://www.wearedevelopers.com/world-congress-north-america/tickets)