Jeetu Patel

Tool authorization and action authorization are two different levels of authorization: tool authorization answers whether an Agent can use a certain integration, and action authorization answers what it can specifically do and to whom.

After giving an Agent access to email, it can book a restaurant, but that does not mean it can freely message board members; these two actions require separate approval.

It is recommended to store each sensitive decision as a triple of "tool, action, target category", for example ("inbox", "reserve", "restaurant") and ("inbox", "message", "board") take different approval paths, and groups that are not pre-approved are intercepted before the call.

Token consumption monitoring should be placed at the same monitoring level as system resilience and guardrail violations, and an Agent's economic behavior should be treated on par with its behavioral boundaries.

Cisco's management of Tokens is phased: first give employees loose Token access so everyone becomes familiar with it, then shift to a Token rationing system like a per-head quota—however many Tokens a team gets, it must deliver corresponding output.

Patel mentioned that the next architectural question is how to increase Token output efficiency by 20% to 60% at the same cost.

Patel suggests first building evals around your own tasks, then using the eval results to decide whether a prompt should be sent to a cheap model or an expensive model; a high score on a public leaderboard does not mean the model performs well in your scenario.

Patel's definition of "cost" is not just the dollar price of Tokens, but also the watts they consume; he mentioned that of the currently available total compute, 60% is being directed toward inference.

Each task must clearly spell out the trade-offs across the three dimensions of intelligence, cost, and control; for tasks where control is more important (such as sensitive data), the last 5% of intelligence may not matter that much.

The human approval step should be retained until the use cases accumulate a trustworthy record; keep human approval until the model is fine-tuned well enough for your environment and you are confident enough in its decisions based on sufficient statistical samples, then consider taking the human out of the loop.