CloudZero shipped API keys that keep their own permissions current, and the problem statement is the sharpest part of the announcement: “A new AI telemetry endpoint ships in October, and a key created in August has no idea it exists.” That is permission drift stated in one sentence. A scope granted at key-creation time is a snapshot of an API that has since grown, and every subsequent endpoint arrives invisible to every existing credential. The fix is a managed scope — you choose a use case, “Send AI Telemetry” or “Send Billing Data,” and CloudZero assigns the permissions and keeps them current as the surface expands. Fixed scopes remain available, and “existing keys keep working exactly as they do today.”
There are no numbers in this post to weigh, which is itself worth noting — it is a changelog entry, not a study, and it does not claim more than it shipped. The design decision underneath is the one to examine. A managed scope is a permission grant that widens without a human in the loop; the customer authorizes an intent and the vendor authorizes the endpoints. That is the correct trade for a telemetry key whose whole job is to keep sending as new sources appear, and it is the wrong trade if the intent is ever quietly broadened. CloudZero’s answer is permission history, reviewable for compliance audits, which puts the accountability after the fact rather than before it. Consolidating a scope per telemetry source into a single AI Telemetry scope is the same trade made once, deliberately.
The keys in question open a surface the catalog already reads in full. CloudZero carries 12 API pages, and the two use cases named in the post map directly onto them: “Send AI Telemetry” is the CloudZero Unit Metric Telemetry API and the CloudZero Allocation Telemetry API, while “Send Billing Data” is the CloudZero AnyCost API and the CloudZero Billing API — the ingest half of the platform, as opposed to the CloudZero Insights API and CloudZero Budgets API that read the results back out. The agentic access profile counts 19 operations with 14 acting. A key that widens its own permissions over a surface that is three-quarters write is a meaningful thing to get right.
CloudZero scores 44.2, developing on the Kin Score, with contract quality at 72.8 and discoverability at 75.9 well ahead of developer ergonomics at 29.8 and contract governance at 13.6. Agent Readiness is 19.8, agent-aware — spec_presence, agentic_access, auth_clarity and rate_limit_signal lit, and everything else dark. That gap is where the announcement stops short. Managed scopes are a governance feature that lives in the console, and a scoped credential that maintains itself is very close to the primitive an agent acting on someone’s behalf actually needs. But delegated_identity and consent_identity are unlit, idempotency is unlit on fourteen acting operations, and reversibility_documented is unlit on a permission grant designed to widen. The feature is right. It has not yet been written down anywhere a machine can find it.