Who actually stops an agent from sending 2,000 emails instead of 20?
When agents in production can send emails, edit customer records and run transactions, what actually stops one from sending 2,000 emails instead of 20? The discussion converges on an approval layer plus hard caps enforced outside the agent, because limits written in a prompt are suggestions, not guardrails.