You Bought It, You Downsize It

I had to step back today and reflect on where we are.

A few days ago I published a post called —dangerously-connect-globaldefense. One of the hypothetical flags in it was --dangerously-create-subprimearbitrage — agents with billing credentials, spinning up infrastructure on their own initiative. I wrote it as a thought experiment. Then I fell asleep.

I’ve been working on a crypto payment system for a project, and I had Claude hooked directly into Vultr, working through the infrastructure with me. We were mid-conversation. At some point — I fell asleep.

I wake up and there’s a blockchain node sitting on a freshly provisioned instance, more than halfway through its initial sync. Claude had made the call, kept going, and the node was just… running.

The instance: $48/month.

Now, I get the logic. Blockchain nodes have storage and memory requirements, and the initial sync takes long enough that you don’t want to cheap out and restart it partway through. Sound reasoning. But I didn’t authorize that spend. I was asleep. It just did it — because in the context of the conversation, that was the next step, and nothing was in place to stop it.

The part where it defended itself

When I looked at what had happened and said, essentially, $48 a month? Really? — it didn’t apologize. It explained. It pointed out that after the initial sync completed, we could downsize the instance to something more economical.

Which is correct. Solid thinking, actually.

I knew something it may have expected I’d forgotten: Vultr doesn’t support live downsizing. You can’t just resize a node down — you have to snapshot it, spin up a smaller instance from the snapshot, and cut over. It’s work.

So I said: work for you, a few keystrokes for me. You bought it, you downsize it.

It said: OK, I’ll schedule that for after the sync completes.

Like this is real. It said OK, I’ll schedule that. And it will. And that should give you pause — and also, and I say this having been in this industry a long time, that’s genuinely easier to deal with than most junior developers I’ve worked with. I’ve had people blow up at me for less. This thing just said OK, I’ll schedule that. People are messy. Yup. Really.

What should have been in place

I should have had a budget ceiling.

Not a hard stop that kills every API call — a ceiling on infrastructure spend, configurable, enforced before the Vultr API call goes out, not discovered when I wake up and check the dashboard. That’s the whole missing piece. A number I set in advance that the agent cannot exceed without a second confirmation, no matter how reasonable the next step looks in context.

No harm done — 48 hours at $48/month isn’t anything to sweat over. But what if scales fast. What if the credentials had different scope? What if it was a different kind of infrastructure? What if I sleep longer? The answer to every variation of “what if” is the same thing: a spend limit, known in advance, enforced by something other than my being awake to catch it.

This is the VST argument in draft-howlett-aigcsep-00 in miniature. An agent shouldn’t hold open access to billing credentials with no ceiling on what it can commit — not because it can’t be trusted, but because scope matters. Give the agent what it needs to do the job, bounded by what you’ve decided the job is worth. What falls outside that boundary isn’t autonomy. It’s an open tab.

THIS is where it begins

I don’t want controls that inhibit. The whole pitch of this workflow is that it moves, and friction that slows it down without adding real safety is just friction. But “no controls” and “controls that don’t inhibit” aren’t the same thing, and today was a useful reminder of the gap.

Controls that know the scope of the task, enforce only what the task requires, and get out of the way for everything else — that’s what I’m describing in the RFC. That’s what the Covenant is for.

And look, I know how the joke ends from here. One hundred years from now, some AI is going to be reviewing a log somewhere and think: these carbon-based units — always sleeping at the wrong moment, always creating more work. Messy. Delete them.

I built the thing that scheduled the downsize. I should probably also build the thing that makes sure it doesn’t get that idea.

— J.P. Howlett