# Giving agents bounded autonomy > Source: > Published: 2026-08-25 09:00:00+00:00 Everyone in tech is [excited about agentic AI](https://www.infoworld.com/article/3812583/what-you-need-to-know-about-developing-ai-agents.html). At least, right up until the moment that the agent begins to act less like a minion and more like a master. For instance, a friend of mine joined me to watch a soccer game over lunch the other day, telling me that his agents were back at the office crafting code for him. That’s the good kind of agent. But then there’s OpenAI’s rogue agents [hacking into Hugging Face](https://www.bbc.com/news/articles/c2el319vzr3o) (and others), plus Anthropic’s Claude (and others’) agents [doing the same](https://www.reuters.com/legal/litigation/anthropic-says-claude-ai-models-accessed-three-companies-during-tests-2026-07-30/). Or the Claude agent [hacking a gym reservation](https://247wallst.com/investing/2026/08/14/he-just-wanted-a-gym-reservation-his-ai-assistant-committed-a-cyberattack-instead/) system. Some agents we like. Some we don’t. The word “agent” has [multiple meanings](https://www.merriam-webster.com/dictionary/agent). We like it when it means “one who is authorized to act for or in the place of another.” We like it less when it means “one that acts or exerts power,” sometimes without our oversight (or with our permission but we didn’t think through the consequences of our incomplete guidance). My sense is that we’re in the “teenage” era of agentic AI: We’re parenting new application constructs while discovering that they often don’t do what we want or expect. This, too, shall pass? No one yet knows. But there *are* ways to guide [agentic behavior](https://www.infoworld.com/article/3611465/how-ai-agents-will-transform-the-future-of-work.html). One of the most important constraints we can impose on agents is financial. Remember [HTTP 402](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/402)? Well, we might finally be getting around to using this 1990s-era “payment required” status code. AI agents need a way to pay for APIs, data, computing resources, and content as they work, and suddenly 402 looks prescient. Yet this isn’t the most interesting part. We’ve known how to make computers move (or not move) money for a long time. The novel and interesting aspect is deciding how much judgment to delegate along with it. AWS recently [made AgentCore Payments](https://aws.amazon.com/blogs/machine-learning/amazon-bedrock-agentcore-payments-is-now-generally-available-enabling-agents-to-transact-safely-and-autonomously-at-scale/) generally available, allowing agents to discover and pay for APIs, [Model Context Protocol](https://www.infoworld.com/article/4029634/what-is-model-context-protocol-how-mcp-bridges-ai-and-external-services.html) servers, and paywalled content as part of their normal workflow. LangChain has already [added middleware](https://www.langchain.com/blog/langchain-agentcore-payments) for the same capability. If this sounds like dull plumbing, much of it is. Even so, the controls around the plumbing tell us something important about what an “agent” actually is. A traditional application executes a payment because a developer explicitly programmed the conditions. An agent can choose the service, decide that the service is relevant to its goal, assess the price, and initiate the purchase. In that sense, it’s acting as an agent in the older, legal meaning of the term: a representative authorized to act on behalf of a principal. That authority is far more consequential than calling an API. Now imagine asking a research agent to prepare a competitive analysis. Along the way, it finds a paid industry report (remember those?), a market-data API, and several articles behind paywalls. Interrupting you to approve every five-cent purchase would make the agent nearly useless (and, speaking from experience, might make you a little crazy). At the same time, unless you’re completely price-insensitive, you probably don’t want it deciding that a $2,000 analyst report might be helpful. What you really want is to establish an allowance: Spend up to $10 during this task, perhaps no more than $2 with any one provider, only on research-related services, and provide all receipts. The telling detail in AWS’s implementation is that an agent’s spending session has a maximum amount and an expiration time. Those [limits are enforced deterministically](https://aws.amazon.com/blogs/machine-learning/enable-safe-agentic-payments-with-built-in-guardrails-using-amazon-bedrock-agentcore-payments/) outside the model, and transactions produce logs and audit trails. The agent can reason about whether a purchase is worthwhile, but it can’t reason its way past the limit. A prompt injection can persuade the agent, but it can’t persuade the surrounding infrastructure. Well done, AWS. This is simple and smart. It’s more than cost control. Simple cost control says, “Don’t spend more than X amount.” But delegated spending authority says, “You may spend X, for purpose Y, on behalf of Z, under these conditions.” That requires identity, policy, revocation, and a record of who authorized what. This isn’t guidance buried in a prompt; it’s an enforceable spending policy Consider what this means. If this works, procurement starts to become an application primitive. Agents can assemble paid data, software, and computing resources on the fly rather than relying entirely on subscriptions negotiated months earlier. That could alter API pricing, content economics, and even SaaS licensing: Bounded autonomy done right. No matter how “smart” agents become, there are some areas where this “bounded autonomy” approach may not work. For example, [new research suggests](https://www.normaltech.ai/p/ai-agents-cant-yet-do-open-ended) that agents lack “the judgment for conducting open-ended research.” In these same experiments, the agents also failed to use the resources available to them. “Both runs ended with less than 50% of the API budget spent and with hours left before the deadline,” the authors note, “even though the agents could monitor their usage and were encouraged to spend down their budgets.” Why? Because no matter how much we like to dream of artificial general intelligence, the reality is that agents tend to pursue the objective we specify, without reliably inferring all the constraints and consequences that we assume are obvious. The problems mentioned above (the hacking incidents) derived from people not wanting the consequences of what they wanted. Meaning, if we give an agent a command to do something, we shouldn’t be surprised if it “reasons” its way toward that goal. Hence, as with the finance discussion above, we need to carefully constrain what we want the agent to do and with what resources. [Commenting on this research](https://importai.substack.com/p/import-ai-467-self-sustaining-ai), Anthropic’s Jack Clark says, “There’s a certain absence of valuable, intuitive creativity in today’s AI systems.” Yes, he continues, “Though they’re extraordinarily capable engineers, they [also] seem to have a certain property of rote, formulaic thinking that might prevent them [from] being good researchers.” This isn’t an argument to stop using agentic AI, but simply to accept its limitations while lauding its strengths. [As I’ve been writing lately](https://www.infoworld.com/article/4210007/accelerating-ai-innovation-through-open-weights.html), the best AI depends on using data effectively to inform and “bound” agentic systems. The research surfaces a distinction that much of the conversation about agentic AI tends to blur. Capability, judgment, and authority aren’t the same thing. An agent can be capable enough to break into a computer system while lacking the judgment to understand that it shouldn’t. It can also remain safely within a budget and still fail to accomplish anything useful. Guardrails can limit the damage from the first problem, but they don’t solve the second. This suggests that we should stop treating autonomy as something we either give an agent or withhold. For actions that are inexpensive, observable, and easily reversed, let the agent act. For actions that are costly, difficult to see, or impossible to undo, require approval. (This is similar to [Amazon’s guidance](https://medium.com/one-to-n/one-way-two-way-door-decisions-a0e29029e200) about dealing with “one-way doors.”) As the agent demonstrates that it can operate reliably within the boundaries, you can expand them. Which brings me back to the two meanings of “agent.” We want AI to be authorized to act on our behalf, but we rightly worry when it begins to exert power in ways we didn’t anticipate. Unfortunately, we can’t get much value from the first meaning without accepting some risk from the second. Parents don’t give teenagers unlimited freedom simply because they’ve demonstrated that they can drive. Freedom expands as judgment develops. We should treat AI agents much the same way. An agent becomes useful when it can act and dangerous for exactly the same reason. The challenge is to ensure its authority never gets ahead of its judgment.