How to Build Spend Limits That Autonomous AI Agents Cannot Override

·16 views

Developers deploying autonomous AI agents for customer-billed tasks face a core security challenge: ensuring agents can request work but cannot modify their own spending limits. The recommended architecture separates authority into three boundaries — policy ownership, reservation before execution, and reconciliation against measured usage — each managed by distinct principals with separate credentials. Before any chargeable work begins, a maximum charge must be reserved, and the ledger must enforce that committed plus reserved amounts never exceed the customer's ceiling. Settlement should occur within the same transactional domain as the reservation, using authenticated meter data rather than agent-supplied figures. OWASP's Secrets Management guidelines are cited as a reference for keeping administrative credentials out of the agent's runtime reach.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Chrony NTP Authentication Requires Per-Peer Keys and a Rotation Plan

Accurate time underpins certificate validation, log integrity and distributed transactions, and an attacker who can influence an unauthenticated NTP association could shift a host's clock. Chrony supports authenticated time through Network Time Security or symmetric keys, but both require an operational plan. The guidance recommends random keys of at least 128 bits, distinct keys per client-server pair, and restrictive file permissions, with rotation done by adding the new key before removing the old one. Operators are also advised to keep source lists intentional and to treat any fallback to unauthenticated NTP as a documented policy decision. NTS is generally preferred where supported, and monitoring for configuration changes, source changes and clock jumps is recommended.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Yardline Lets Crews Confirm Deliveries via Secure, No-Login Links

Yardline, a tool for handling handoffs between building suppliers and contractors, lets crew leads on site confirm deliveries without creating an account. Instead, the office sends the crew a link by text message that opens a single delivery, where they can check the contents, note missing or damaged items, and mark it received. The design treats the link as a secure, expiring credential: tokens are 256-bit random values, only their SHA-256 hashes are stored, and links expire within one to 30 days by default after seven. Offices can revoke links at any time, and actions taken through them are logged under a separate guest identity rather than the office user who created the link. Search engines are also barred from indexing the pages, and each request revalidates the token.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Censys Finds 1,465 Exposed Artex AI Attack Consoles Identified by Page Title

Censys reported on November 4, 2026 that it observed 1,465 hosts running an exposed console for Artex, an open-source LLM-driven autonomous penetration testing framework. The framework has been linked by Microsoft and others to recent intrusion campaigns, including a ConnectWise supply-chain compromise and an intrusion into WorkOS's sales tool. Roughly 650 of the hosts sit in two blocks of identically configured hosting, and Censys notes that some may be run by authorized testers. About one in ten hosts also ran other detected threats, and some exposed open directories containing session histories and configuration files. Censys located the consoles by matching HTML page titles beginning with "ARTEX" and Next.js static asset references, noting that customized consoles with different titles would not be captured.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why identical-looking Galaxy phones can run different firmware versions

Two Galaxy phones with the same name can run different firmware because Samsung sells many hardware variants under one marketing name, each with its own model number. Firmware is built for a specific model number, so an update for one variant does not apply to another. Region-specific CSC codes and carrier approval steps also determine which update schedule a phone follows, so unlocked and carrier phones often receive updates at different times. Security patches and major feature updates are released in separate staged rollouts, so a gap of a few weeks between otherwise identical phones is normal. Checking the full model number and CSC under About phone is the first step in explaining a mismatch.

0 comments Read more at DEV Community