Your AI Agent Needs a Credit Limit

We spent years teaching models how to act. The next valuable layer will decide what they are allowed to do.

Under the refund rule in Amazon’s AgentCore tutorial, a $999 refund can pass. At $1,001, the same agent hits a hard stop. The difference is not intelligence. It is authority.

Amazon’s tutorial demonstrates the boundary with $500 and $2,000 refunds. The agent can call the same tool in both cases. A rule outside the model—“Only allow refunds under 1000 dollars”—decides which one executes.

It is a wonderfully boring example. It is also a preview of the architecture that will decide how much autonomy enterprises are willing to buy.

For most of the generative AI era, the industry has focused on making models more capable. First they answered questions. Then they wrote code, navigated websites, called tools, and began completing multi-step jobs. Each improvement pushed the agent closer to the place where software becomes economically interesting: the moment it changes something in the real world.

That moment also changes the problem.

A chatbot can be wrong. An agent with a corporate card, a production credential, or the ability to issue refunds can be expensively wrong. The model may be intelligent enough to propose an action. It should not be trusted to determine its own authority.

The next important AI control point, then, may not sit inside the model at all. It will sit between intention and execution: a layer that can answer, in real time, is this agent allowed to do this specific thing, for this person, under these conditions, right now?

Every autonomous system eventually invents brakes. AI agents are about to get theirs.

A Login Is Not a Permission Slip

Security systems have long separated identity from authorization. Agents make that old distinction impossible to ignore—and push it to a finer grain: authority scoped to a delegated task and each consequential action inside it.

An agent may act for a user, call several tools, delegate part of a task, encounter new information, and change its plan along the way. The same identity might reasonably read a customer record, draft a refund, and send a confirmation email. That does not mean it should approve any amount, contact every customer, or keep operating after the task has changed.

Microsoft has already acknowledged the distinction. Entra Agent ID gives agents a dedicated identity type and blocks many high-privilege roles and permissions, even when an administrator might otherwise grant them. That is an important start: stop treating an autonomous agent as either a full human user or a generic background application.

The questions NIST raises point toward a practical design challenge: bind that identity to task context—who delegated the job, which tools and records it requires, how much money or compute it may consume, which actions are reversible, when an exception needs a person, and when the authority expires.

Authority Has to Sit Outside the Model

The simplest architectural rule is also the most important: the model cannot be its own policy engine.

Telling an agent “never issue a refund above $1,000” is an instruction. It is not enforcement. The same probabilistic system that interprets a customer’s request is still being asked to police itself while processing that request.

The alternative is a deterministic checkpoint in the path to every consequential tool call. The agent proposes. The policy layer evaluates the action and its context. The underlying system executes only what survives.

Amazon’s AgentCore Policy does this at a gateway outside the agent’s code. It can evaluate the tool, identity, and input parameters before allowing the call. Its refund tutorial defaults to denial unless a rule explicitly permits the action. Google’s Agent Gateway similarly uses identity-aware enforcement and can extract attributes from agent traffic to restrict access to particular tools.

These products are early, but their shared shape matters. The policy is not another paragraph in the prompt. It is infrastructure in the execution path.

A useful control plane binds agent and user identity to the minimum scope required for a job, enforces hard limits on money and affected systems, routes exceptions to a person, and records what was requested, allowed, denied, and executed. None of this is cinematic. That is exactly why enterprises may trust it near production.

The Brake Pedal Makes the Car Faster

Security is often framed as the tax autonomy pays on its way into the enterprise. In this case, it is the thing that makes autonomy purchasable.

Consider a customer-support agent with no meaningful limits. It can recommend refunds, but a person must review every one.

Now give it bounded authority. It may autonomously refund up to a defined amount for an eligible order, while unusual cases route to a person. Suddenly the safe path has no human bottleneck. The boundary does not merely prevent bad actions; it expands the set of actions the company is willing to automate.

This creates a useful paradox: the systems that say “no” most reliably may unlock the most “yes.”

The pattern travels well beyond refunds. A finance agent can prepare payments but release only those below a threshold to approved vendors. A cloud-operations agent can restart a service but not delete a database. A procurement agent can reorder known supplies but not add a new supplier. A healthcare agent can assemble a prior-authorization packet but not make the clinical decision.

This is why the problem is larger than “AI safety” as a compliance category. The control layer is part of the product’s throughput. Better boundaries increase the volume of work that can happen without interruption.

The Need Is Real. The Category Is Not.

There is an easy—and dangerous—venture conclusion here: agents need authorization, therefore agent authorization will produce a large new horizontal software category.

Perhaps. But the cloud platforms have noticed the same thing.

AWS is putting policy beside its agent gateway. Microsoft is extending its identity system around agent-specific constraints. Google is bringing identity and authorization into agent traffic. Existing identity, API management, observability, and security vendors all have credible routes into the stack.

The generic ability to allow or deny a tool call may become a feature.

The more interesting opportunity sits one layer closer to the business decision. A horizontal gateway can see that an agent requested process_refund(amount=900). It may not know whether the order was delivered, whether the customer has already received a concession, whether the item is returnable, whether the support rep’s region has a different policy, or whether a fraud model has flagged the account.

That context determines whether the action is merely permitted or actually sensible.

An independent company begins to look plausible only when it owns the policy graph for a high-value workflow, sits in the path where credentials and approvals can actually be enforced, or turns exception decisions into better boundaries over time. That favors founders who begin with a painful operational wedge, not a universal “governance layer” in search of one. The product may look like a refund platform, a production-operations console, a healthcare workflow, or a treasury system before it looks like agent infrastructure.

The questions NIST posed in its 2026 concept paper map the points where today’s identity stack is being stretched: how authority changes with context, how an agent proves it may perform a specific action, how delegated authority binds back to a person, and how actions become tamper-resistant records.

Follow the Denials

The early agent market has been measured by capability: benchmark scores, tasks completed, tools connected, minutes saved. The next phase will also be measured by delegated authority.

How much money can an agent move without review? How many production changes can it make? How quickly does an exception reach the right person? Can a company reconstruct why an action happened? Does each completed task make the next permission boundary easier to set?

This becomes a moat only if exception decisions become structured policy that makes the next boundary cheaper and more precise. If every customer’s rules remain bespoke—or cloud platforms own the enforcement point—the control layer is a feature, not a company.

That is the test: not whether software can watch agents work, but whether it can help them earn more authority.

The AI industry has spent years giving agents better brains. The next move is to give them a credit limit—and make every increase in that limit earned.