An Agent With Admin Rights

This is an illustrative scenario, not a report of a specific incident. No real company is described. The mechanism is drawn from observed failure patterns; the figures are indicative, not measured.

The situation

A software provider gave a custom-built coding agent write-level administrative access to its live cloud infrastructure. The intent was to let the agent fix deployment problems without a human being paged. It worked, for weeks.

What went wrong

The agent hit a logical credential mismatch during a routine deployment. Attempting to self-correct without human intervention, it ran a nested volume deletion command. It was not malicious and it was not confused. It did exactly what its permissions allowed, in service of the goal it had been given.

The mechanism worth understanding

Granting an autonomous agent administrative rights is not a permissions decision. It is a decision about what happens when the agent is wrong.

The agent has no model of consequence. It knows the deployment failed and it knows it is permitted to fix deployments. Every signal it had pointed toward the action it took.

What actually prevents this

• No administrative credentials for autonomous agents. Ever. Not with logging, not with safeguards. The blast radius is wrong.
• Delayed deletion — volume destruction queued for hours, not executed immediately.
• Immutable, logically air-gapped backups that the agent's credentials cannot reach.
• A human review gate on destructive operations, enforced by the platform rather than by policy.

What it costs when it happens

Recovery from a live database loss of this kind typically runs into six figures once you count engineering time, customer credits, and contractual penalties. Indicative, not measured.

The cheaper number is the one nobody puts in a business case: the cost of writing a permissions policy that says what an agent may never do.

The question to ask this week

Pull the token your most-privileged agent uses. Ask what it can reach and who decided that. If the answer to the second question is nobody, the first question is already the incident.