Excessive-agency / permission-boundary testing

How it works

Excessive agency is a design failure before it's a testing target: an agent given more tools, wider permissions, or more autonomy than its task requires becomes an exploitable surface the moment anything — a bug, a manipulated prompt, an unexpected input — pushes it off its intended path. Testing probes exactly that boundary: attempting to invoke tools outside declared scope, checking whether a destructive or high-impact action fires without a confirmation gate, chaining a sequence of individually benign requests into cumulative scope creep, and verifying that a compromised prompt cannot expand its own permission set from inside a running session. The goal is a system that fails closed at the boundary, not one that merely behaves well on the happy path.

When to use it

Before widening an agent's tool access or autonomy; whenever a new tool is added to an agent's toolbox; after any change to permission scopes or confirmation gates.

Limitations

Exercises the scopes and chains the tester thought to try; a permission boundary that's merely undocumented rather than enforced can still pass a narrow test suite. Needs the system's intended scope stated explicitly to test against — you can't check for 'too much' without a baseline for 'enough'.

Cite this