Your security team knows how to answer what an AI agent may read. That is a permissions question, and permissions are a solved problem. AI agent write access is a different question with a different failure mode, and most teams grant both in the same credential without ever separating them.
Read Access Is a Permissions Question. Write Access Is Not.
A read scope, meaning the set of operations a credential is permitted to perform, fails in a way your organization already understands. Somebody sees something they should not have seen. It is serious, it is bounded, and there is an established playbook for it.
A write scope fails differently. The agent does something, the something is now true, and the question is not who saw it but whether it can be taken back. That question has almost nothing to do with how sensitive the data was and almost everything to do with what kind of operation it was. Updating a record is usually undoable. Sending money is not. Emailing a customer is not. Deleting a row might be, if somebody set up the backup and somebody else knows how to use it.
Two of our earlier pieces cover the surrounding problem. The containment controls after the Hugging Face breach deal with the agent environment: egress, credentials, monitoring. The four gates before an agent reaches production deal with readiness. Neither answers which specific operations the agent should be able to perform once it gets there. That is this question, and it gets decided by whoever writes the integration.
What a Platform Did When It Had to Decide
On 20 August 2026 Binance launched Agent OS, a developer platform that connects AI applications to its trading, market data, wallet and payment capabilities. Agents can analyze markets, place orders on their own, run strategies, and settle payments. Users connect it from ChatGPT, Codex, Claude Code or Cursor.
The interesting part is not the capability. It is the shape of what they carved out. Withdrawals from agent subaccounts are blocked by default rather than merely permissioned. Each agent is assigned a dedicated subaccount so its funds and activity are segregated from everything else. Access can be revoked at any time. Agents cannot reach non-trading account information such as an email address or identity records. And the daily caps are asymmetric in a way that repays attention: roughly 50,000 dollars for swaps and 100,000 for decentralized finance activity, against 20 dollars for outbound payments.
Read those three numbers next to each other. The cap is not scaled to how much money is involved. A large position can usually be unwound. An outbound payment leaves and does not come back, so it gets a limit five thousand times smaller than the one next to it.
Binance is explicit about why the boundary has to be structural. In its own announcement it says that the agent external information sources, interpretation and decision-making are managed inside the user chosen AI application and are not visible to Binance. The platform granting the authority told you it cannot see the reasoning behind any individual instruction. So the safety cannot live in judging instructions. It has to live in which operations exist at all.
Sorting Agent Actions by What Undoes
Before granting a write scope, list every operation it contains and put each one in a tier. Do this as a written artifact, not as a conversation, because the value is that somebody can disagree with a specific line later.
Reversible: the agent acts
Operations with a clean undo that your team could execute without a meeting. Updating a status, adding a note, creating a draft, adjusting an internal field. If the worst case is that somebody fixes it in the morning, the agent does not need to ask.
Reversible at a cost: the agent acts and somebody is told
Operations that can be walked back but where the walking back is visible, expensive, or awkward. Reassigning ownership, changing a price, closing a ticket, cancelling a scheduled job. Let the agent do these, notify a human when it does, and write the undo path down before launch rather than discovering it during the incident.
Irreversible: not in the reach of the agent
Money leaving, messages to customers, deletions without a restore path, anything a regulator would want a person named for. The instinct is to permission these carefully and require approval. The stronger move is the one Binance made with withdrawals: leave them out of the surface the agent can call at all. An approval prompt is a control that depends on somebody reading it at four in the afternoon on a Friday. A missing endpoint does not depend on anyone.
The Question to Ask Before You Grant It
For each operation on the list, ask how it gets undone at two in the morning and who does the undoing. If the answer is a documented procedure and a named on-call role, the operation can sit in tier one or two. If the answer is a pause, it belongs in tier three, and the honest version of that decision is to remove it from the scope rather than to write a policy asking the agent not to use it.
This costs an afternoon and it survives every model change, because it is a statement about your operations rather than about the agent. The capability underneath will keep improving. Which of your operations can be taken back will not.
Key Takeaways
- Read access fails in a way organizations already handle. Write access fails by making something true, and the recovery depends on the operation type rather than on data sensitivity.
- Binance shipped agent trading on 20 August 2026 with withdrawals blocked by default, per-agent subaccounts, revocable access, and daily caps that track reversibility rather than value.
- Its outbound payment cap sits at 20 dollars against 100,000 for decentralized finance activity, because a position can be unwound and a payment cannot.
- Sort every operation in a write scope into reversible, reversible at a cost, and irreversible, as a written artifact somebody can argue with later.
- For irreversible operations, removing them from the callable surface beats requiring approval, because a missing endpoint does not depend on anyone reading a prompt.
Frequently Asked Questions
Is an approval step not enough for the irreversible tier?
It is better than nothing and it degrades in a predictable way. Approval prompts get read carefully for about two weeks, and then they get clicked. The failure is not that people are careless; it is that a prompt arriving hundreds of times with no incident trains the reader that it is noise. Where the operation genuinely has to stay available, pair the approval with something structural, such as a value ceiling, a delay before execution, or a second named approver for anything above a threshold.
We are not a trading platform. Does the example transfer?
The vertical does not matter; the operation types do. Every business has the same three tiers under different names. An outbound payment is a wire, a refund, or a purchase order. A message to a customer is an email, an SMS, or a status page update. A deletion without a restore path is the same everywhere. The useful import from a platform like this is not what it built but that it had to publish where the line sits, which most internal integrations never do.
Who owns this list?
Whoever owns the system being written to, not the team building the agent. That distinction matters, because the agent team optimizes for capability and the system owner carries the incident. Make the list a joint artifact, have the system owner sign the irreversible tier specifically, and revisit it when either the agent scope or the underlying API changes.
Sources
- Binance, "Binance Introduces Agent OS to Connect AI Applications to Financial Infrastructure," 2026. Link.
- TechCrunch, "Binance now lets AI agents trade, but keeping them in check is largely up to users," 2026. Link.
- Cointelegraph, "Binance opens crypto trading to AI agents with user-set controls," 2026. Link.
Next Steps
If an AI agent in your organization holds a write scope that nobody has sorted by reversibility, the decision has already been made by whoever wrote the integration. Stable Solutions maps agent write authority against your operations, removes the irreversible calls from the surface, and documents the undo path for everything that stays. Explore our AI Automation services or contact our team to review a scope before it goes live.