On Runtime, any key can be made read-only or given a daily spending limit. No key can loosen its own terms. A read-only key sees the whole account and spends nothing. A limited key's agent can commit at most the sum you set in any 24 hours (security).
Why it matters for AI agents
NIST defines least privilege as restricting access "to the minimum necessary to accomplish assigned tasks". An agent is the case this rule was written for. An agent runs on instructions that it did not write. Text in a file or on a web page can steer it. It acts fast and does not pause. A dashboard that only reads should hold a key that only reads. A coding agent that creates sandboxes all night should hold a key with a ceiling on what it can spend. Then a mistake or an injected instruction is limited by the key, not by the whole account.
One key per agent also helps. Each key appears separately in the audit log, and revoking one key leaves the others working.
Runtime's key controls
| Control | What it does |
|---|---|
| Read-only key | Sees every sandbox's state, spec and cost, images, volumes, snapshots, balance. Changes nothing. |
| Not visible to it | Files and command output inside sandboxes, job runs and secrets |
| Daily spending limit | The most a key's agent may commit in any 24 hours, counting what running sandboxes will use |
| Past the limit | Create, wake, extension or renewal fails with spending_limit_reached (HTTP 402), with no charge |
| Per create | maxTotalCostMicros stops a sandbox once it has cost that much in total |
| Reach | A key acts on what it created. Only an owner or admin can create a key for the whole account. |
| Who sets limits | The member who made the key, or an owner or admin, on the website. No key can set its own limits. |
| Record | Every key made, revoked or limited is in the audit log, with who did it and from where |
Both controls are optional. They cover every Cloud product, including products added later.
Make and check one
From a terminal, each request opens a browser approval for an owner, admin or developer:
Terminalruntime keys create --name monitor --read-onlyruntime keys create --name nightly-agent --daily-limit 25Code that runs on a key can read its own terms before it starts work:
TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();const { access, daily } = await runtime.limits.get();console.log(access, daily.remainingMicros); // "read", "full" or "selected"Pythonfrom withruntime import Runtimewith Runtime() as runtime: limits = runtime.limits.get() print(limits["access"], limits["daily"]["remainingMicros"])An agent connected through MCP asks the same question with runtime_account,
action limits. A client that asks for the scope runtime:read during MCP
sign-in gets a read-only key (remote connection).
The SDKs do not retry a spending_limit_reached error. The agent should stop
and tell the person it works for.
Room under a limit returns as older spending leaves the 24-hour window. A running sandbox keeps the time it is already funded for when the limit is reached. A sandbox whose next renewal would pass the limit stops or pauses at that point.
Related
- What is a spending limit?
- What is workload identity?
- How to create a read-only key
- How to set a daily spending limit
- Security
- CLI: keys for CI
Sources
- NIST CSRC glossary: least privilege, definition from NIST SP 800-12 Rev. 1, read 25 October 2026
Facts on this page were checked on 25 October 2026.