--- title: "AI agent manages cloud resources: limits in operations" url: https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-manages-cloud-resources lang: en updated: 2026-10-17 license: © Innopulse Consulting GmbH --- # AI agent manages cloud resources: limits in operations Operations agents monitor systems, react to load and optimize costs. To do so, they access the cloud's control plane, where a single wrong command can take down a service or trigger high costs. [Leutrim Miftaraj](https://knowyouragent.ch/en/about/leutrim-miftaraj), Founder, Innopulse Consulting GmbH Published 17 October 2026 ## Key points - An operations agent scales, starts and changes cloud resources; mistakes cost money or take services down. - Destructive actions such as deletion do not belong in routine but go to approval. - Every change is checked against the mandate before execution and recorded as a receipt. ## Starting point A company runs its application in the cloud. An agent watches load and costs, starts additional servers at peaks, stops unused test environments and proposes savings. With administrator rights, however, it could also delete databases or change access rights, by mistake or because a manipulated message leads it to. ## Flow with evidence - **Own identity:** the agent receives a [workload identity](https://knowyouragent.ch/en/knowledge/glossary/workload-identity) with rights only for the intended resources. - **Mandate:** scaling within defined limits, stopping test environments, a daily budget; no deletion, no changes to rights. - **Decision:** every change goes to a decision service before execution. - **Approval:** destructive or costly changes go to a responsible person. - **Execution and receipt:** the change is executed and recorded with a reference to the decision. ## Risks and countermeasures - **Destructive commands:** deletion, overwriting and rights changes never automatically, only with approval. - **Cost explosion:** a daily budget in the mandate limits how many resources the agent may start. - **Manipulated messages:** content from logs or tickets must not trigger actions outside the mandate. - **Overly broad rights:** [least privilege](https://knowyouragent.ch/en/knowledge/glossary/least-privilege) at the cloud and mandate level. ## Roles and responsibilities - **Platform team:** defines rights, budgets and allowed actions. - **On-call staff:** decide on approvals, at night too. - **Security:** monitors denied decisions and unusual patterns. ## How the certificate looks For scaling up by four servers, KYA verifies mandate, decision and receipt. The verdict is valid. If the agent tries to delete a database, the action is not in the mandate; the decision service denies it, and without approval the scope check reports action_not_in_scope. ## Adoption Start with read access and proposals, then reversible actions such as scaling. Destructive actions stay with people permanently. For code changes, the use case [AI agent runs code deployments](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-runs-code-deployments) describes the approach. ## Operating metrics The platform team tracks the number of changes executed automatically, denied decisions by reason, approvals outside working hours and costs compared with the budget. A rise in denied deletion attempts is a warning sign of misconfiguration or manipulation. ## Frequently asked questions ### Should an AI agent manage cloud resources on its own? For reversible actions such as scaling within limits, yes. Destructive actions such as deletion should always require human approval. ### How do I limit costs? With a budget in the mandate that the decision service checks before every action, in addition to the cloud's budget alerts. ### Which rights does the agent need? Only those needed for its tasks, through its own workload identity. Administrator rights are not among them. ### What happens with an attack through logs? If a log contains a manipulated instruction, the resulting action fails the check against the mandate. ### What does KYA verify in cloud operations? Mandate, decision and receipt of every change. KYA does not verify cloud configuration but the evidence of authority. ### May the agent intervene during an outage? For predefined, reversible measures such as restarts or scaling, yes. Everything else it escalates to on-call staff. ### What is a break-glass procedure? A documented emergency access with extended rights that only people use and that is logged in full. Agents do not receive it. ### How do I test an operations agent's mandate? In a test environment with deliberately impermissible instructions. Every one of these actions must fail at the decision service. ### Can the agent cut costs by deleting resources? It can propose deletions. A person should carry them out, because deletions cannot be reversed. ### How do I prevent the agent from extending its own rights? Rights changes never belong in an operations agent's mandate. The cloud rights of its workload identity do not allow changing rights. ### May the agent restore backups? A restore can overwrite current data. It should therefore require approval by a person. ### How do I document an operations agent's actions? With receipts per change that refer to the decision, complemented by the cloud's logs. Together they show what was allowed and what happened. ### May the agent change network rules? Changes to firewalls and network rules affect the security of all systems. They should not be part of an operations agent's mandate. ## Sources - NIST SP 800-207: Zero Trust Architecture: [https://csrc.nist.gov/pubs/sp/800/207/final](https://csrc.nist.gov/pubs/sp/800/207/final) - NIST: Least Privilege: [https://csrc.nist.gov/glossary/term/least_privilege](https://csrc.nist.gov/glossary/term/least_privilege) --- Quelle: https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-manages-cloud-resources · KYA – Know Your Agent