Your agent can spend money now. The thing that limits what it can change is still in private beta

For two years the entire agent-permissions conversation has been about reading what can it see, what's in the context, is our data going to a third party. That was always the easy question, and this week is the bill arriving for having answered only that one. The permission that costs you money is write. The permission that costs you money literally is spend. Both landed this week, from serious infrastructure vendors, in production. Read access loses you a secret. Write access loses you a repository, a customer record, a production deployment. Spend access loses you the actual money, at machine speed, at three in the morning, in a loop nobody was watching. Three things follow, none of which need a security team. First, inventory your writes: go through every MCP server and tool your agents can reach and sort each into Cloudflare's tiers; read-only, minimal impact, contained write, critical. Most teams have never done this and are surprised by what's in the top bucket. Second, copy Binance's homework: a separate account with its own funds, withdrawals off by default, hard daily caps, one-click revocation. That is not crypto-specific; it is how you should scope any agent touching a budget, an API key or a production system. Third, make the agent wear a name tag. Cloudflare's decision not to create separate agent identities is the sharpest design call of the week. An agent acting as your user, with your permissions, tagged in the audit log as an agent, is investigable. The uncomfortable version: a lot of teams are about to discover that they gave an agent a wallet before they gave it a ledger.