Bound autonomy with scopes, limits, and spend caps

Cap what an agent can do per session. Rate limits, scopes, and spending ceilings prevent runaway loops and surprise bills.

Why

Unbounded autonomy is a documented risk class, not a theoretical one. OWASP LLM10:2025 (Unbounded Consumption) names "Denial of Wallet" as a distinct failure mode: an agent trapped in an infinite loop or repeatedly invoking expensive APIs can exhaust a budget before anyone notices, because each call costs real money. OWASP MCP02 (Privilege Escalation via Scope Creep) adds that agent permissions expand over time when they are not actively constrained. Hard limits on tokens per session, cost per day, and actions per session must live in the infrastructure layer — not in the agent's prompts or application code, where the agent can reason around them.

Do

Set per-agent rate and spend caps.

Don't

Grant unbounded autonomy by default.

Artifact

{
  "agent": "acme-support-bot",
  "limits": {
    "requests_per_min": 60,
    "max_spend_usd_per_day": 100,
    "max_actions_per_session": 200,
    "scopes": ["orders:read", "refunds:write"]
  }
}