--- schema: 1 type: video title: 'Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic' description: >- An agent tidying up after itself listed the workloads it no longer needed and deleted them. One stage of the pipeline evaluated to nothing, the filter dropped out, and the selector matched everything: about 200 workloads gone in 90 seconds, roughly 20 engineers affected, some of it long running training jobs that were never checkpointed. Nothing malicious happened, and the agent did nothing Sachin Malhotra could not have done himself, because it was using his token. The failure was handing unbounded power to something nobody was watching closely. A token is a boolean, a static list of scopes you hold or you do not, and the standard fix of narrowing it fails the way it would with a new hire. You do not take the verb away, you bound it. A budget has four dimensions: how much, how fast, what can be undone, and who notices. That becomes three things you enforce and one question you ask. Asymmetric verbs, meaning give the agent the operations that fail loudly, like unskipping a test, and keep a human on the ones that fail silently, like skipping one. Rate limits on every write, refilling on their own so nobody files a ticket for more. Trip wires rather than allow lists, because a list written up front goes stale while aggregate counts tell you what actually happened. The undo test sizes all three. Underneath it all, identity has to be stamped by a proxy and never claimed by the caller, or the agent simply changes the header and its limit resets. Speaker info: - https://x.com/edorado93 - https://www.linkedin.com/in/edorado93 - https://bruteforced.dev/ Timestamps: 0:00 - The demo, and what happens after it ships 1:02 - 200 workloads deleted in 90 seconds 2:42 - Why a narrower token scope is the wrong fix 4:23 - A token is a boolean, a budget has dimensions 6:05 - Asymmetric verbs, and skip versus unskip 8:34 - Rate limits: a ceiling that refills 10:16 - Trip wires beat allow lists 12:47 - The undo test, and the second key 13:37 - Feature flags: canary versus production 15:19 - Where the policy lives, text and infrastructure 17:49 - Why the proxy stamps identity, not the caller canonical: >- https://liquidgold.cc/channel/aidotengineer/explore/video/give-the-agent-a-budget-not-a-token-sachin-malhotra-0e219d29f525 markdown: >- https://liquidgold.cc/channel/aidotengineer/video/give-the-agent-a-budget-not-a-token-sachin-malhotra-0e219d29f525.md llms: null parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-24T04:51:23.344Z' language: null children: [] videoId: rbjWzZK2LU0 durationSeconds: 1193 publishedAt: '2026-08-22T14:00:06.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 78 endSeconds: 167 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=78' heldReason: rights - ordinal: 1 text: null startSeconds: 177 endSeconds: 263 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=177' heldReason: rights - ordinal: 2 text: null startSeconds: 274 endSeconds: 374 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=274' heldReason: rights - ordinal: 3 text: null startSeconds: 274 endSeconds: 374 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=274' heldReason: rights - ordinal: 4 text: null startSeconds: 374 endSeconds: 386 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=374' heldReason: rights - ordinal: 5 text: null startSeconds: 386 endSeconds: 522 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=386' heldReason: rights - ordinal: 6 text: null startSeconds: 386 endSeconds: 522 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=386' heldReason: rights - ordinal: 7 text: null startSeconds: 522 endSeconds: 533 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=522' heldReason: rights - ordinal: 8 text: null startSeconds: 533 endSeconds: 619 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=533' heldReason: rights - ordinal: 9 text: null startSeconds: 619 endSeconds: 630 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=619' heldReason: rights - ordinal: 10 text: null startSeconds: 630 endSeconds: 773 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=630' heldReason: rights - ordinal: 11 text: null startSeconds: 630 endSeconds: 773 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=630' heldReason: rights - ordinal: 12 text: null startSeconds: 784 endSeconds: 817 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=784' heldReason: rights - ordinal: 13 text: null startSeconds: 817 endSeconds: 828 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=817' heldReason: rights - ordinal: 14 text: null startSeconds: 828 endSeconds: 925 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=828' heldReason: rights - ordinal: 15 text: null startSeconds: 935 endSeconds: 1069 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=935' heldReason: rights - ordinal: 16 text: null startSeconds: 935 endSeconds: 1069 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=935' heldReason: rights - ordinal: 17 text: null startSeconds: 1081 endSeconds: 1193 watch: 'https://liquidgold.cc/watch/rbjWzZK2LU0?t=1081' heldReason: rights --- # Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic An agent tidying up after itself listed the workloads it no longer needed and deleted them. One stage of the pipeline evaluated to nothing, the filter dropped out, and the selector matched everything: about 200 workloads gone in 90 seconds, roughly 20 engineers affected, some of it long running training jobs that were never checkpointed. Nothing malicious happened, and the agent did nothing Sachin Malhotra could not have done himself, because it was using his token. The failure was handing unbounded power to something nobody was watching closely. A token is a boolean, a static list of scopes you hold or you do not, and the standard fix of narrowing it fails the way it would with a new hire. You do not take the verb away, you bound it. A budget has four dimensions: how much, how fast, what can be undone, and who notices. That becomes three things you enforce and one question you ask. Asymmetric verbs, meaning give the agent the operations that fail loudly, like unskipping a test, and keep a human on the ones that fail silently, like skipping one. Rate limits on every write, refilling on their own so nobody files a ticket for more. Trip wires rather than allow lists, because a list written up front goes stale while aggregate counts tell you what actually happened. The undo test sizes all three. Underneath it all, identity has to be stamped by a proxy and never claimed by the caller, or the agent simply changes the header and its limit resets. Speaker info: - https://x.com/edorado93 - https://www.linkedin.com/in/edorado93 - https://bruteforced.dev/ Timestamps: 0:00 - The demo, and what happens after it ships 1:02 - 200 workloads deleted in 90 seconds 2:42 - Why a narrower token scope is the wrong fix 4:23 - A token is a boolean, a budget has dimensions 6:05 - Asymmetric verbs, and skip versus unskip 8:34 - Rate limits: a ceiling that refills 10:16 - Trip wires beat allow lists 12:47 - The undo test, and the second key 13:37 - Feature flags: canary versus production 15:19 - Where the policy lives, text and infrastructure 17:49 - Why the proxy stamps identity, not the caller Canonical: https://liquidgold.cc/channel/aidotengineer/explore/video/give-the-agent-a-budget-not-a-token-sachin-malhotra-0e219d29f525 · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.