The permission is the quietest part of the system. Nobody watches it during a demo. But it is the part that moves money.
The Permission Gap: Why Agents Spend Money Differently
A person making an expensive mistake has to do something — click a button, type a command, approve a purchase. There is friction. There is a moment where the brain can catch up.
An agent with a permission does not have that moment. It acts at machine speed, across multiple API calls, before the first invoice email lands. The gap between “this key has write access” and “the account is drained” is measured in seconds, not in human attention cycles.
This is not a hypothetical. The OWASP Gen AI Security Project flags excessive agency as a distinct risk category — the system has permission to act, and the human has no chance to review the action before it happens. The capability is the vulnerability.
Real-World Vectors: API Keys, Cloud Costs, and SaaS Subscriptions
Consider a common pattern: a GitHub Actions workflow that uses a stored secret to call a SaaS API. The secret was provisioned for one task — sending a summary report once a day. But the workflow has a bug in its trigger logic, or an attacker finds a way to inject a malformed input that causes the step to loop.
Suddenly that single API key is making a burst of calls the team did not intend. The SaaS tool charges per call. The cloud provider charges per compute minute. Nobody checks the logs until the monthly bill arrives, and by then the damage is done.
The same pattern applies to cloud provisioning. An agent with permission to spin up compute instances, granted for a legitimate batch job, can accidentally launch a GPU cluster that costs significant money per hour. The agent does not know what money is. It only knows the permission says “yes.”
Approval Gates: Not Just a Speed Bump
The instinct is to say “approval gates will slow us down.” That is true, and it is the wrong framing.
An approval gate is not a speed bump. It is a state check — a moment where the system asks “is this action within the expected range?” before executing. For high-cost or high-privilege actions, the gate should require a human to confirm. For medium-cost actions, it can be an automated check against a threshold: “this API call would bring the daily spend over a defined limit — deny until reviewed.”
The key is to make the gate contextual. Not every action needs one. But the ones that can spend real money should have a pause built in.
Quotas and Rate Limits as Hard Boundaries
Approval gates are about what can happen. Quotas are about how much can happen.
A quota is a hard ceiling on resource consumption over a time window. For an agent, this means setting a maximum number of API calls per hour, a maximum cloud spend per day, or a maximum number of provisioned instances. The quota is enforced at the platform level — the agent cannot exceed it, no matter what permission it holds.
This is not a substitute for least privilege. It is a complementary safety net. Even if the permission is too broad, the quota limits the blast radius.
Least Privilege: The Principle That Saves Budgets
Least privilege is the oldest security principle, and it applies directly to cost control. An agent that only needs to read a SaaS report should not have write access to that SaaS tool’s billing API. An agent that only needs to trigger one specific workflow should not have access to all secrets in the repository.
The mistake is granting permissions based on what the agent might need in the future, rather than what it actually needs for the current task. That future-never-comes permission is the one that gets abused.
Audit Trails: Finding the Leak Before It Drains the Account
Even with gates and quotas, things will slip. An audit trail is the last line of defense — a log of every action the agent took, with timestamps, resource IDs, and the permission used.
The trick is to watch the audit trail, not just store it. Set alerts for unusual patterns: a sudden spike in API calls, a new resource type being provisioned, an agent operating outside its normal hours. These alerts should go to a human who can investigate before the next billing cycle.
The cost of ignoring the audit trail is the cost of finding out too late. And the bill always comes due.
