Detect Boundary Crossing and Respond Safely

Detect Boundary Crossing and Respond Safely

Recognize unauthorized goal expansion, dangerous tool sequences, and policy bypass while keeping automated response proportional to certainty.

Excessive agency appears when authority outruns the intended task

Suppose a travel agent is asked to compare flights. It searches schedules, reads a loyalty profile, books a ticket, changes the account email address, and sends the itinerary to a new external recipient. None of those operations is inherently malicious. Their sequence, however, has moved far beyond comparison. Detection begins with the relationship between the requested goal, the authority granted, and the consequence produced.

Excessive agency means that a system can take actions beyond what is necessary or intended for its task. It can arise from broad permissions, weak confirmation requirements, ambiguous goals, tool descriptions that invite misuse, or untrusted input that redirects the plan. Detecting Excessive Agency and Confused-Deputy Behavior explains why you should observe both capability and use. A powerful permission creates exposure; an unexpected exercise of that permission creates evidence about an event.

A single rare tool call may be weak evidence. The relationship among calls is often stronger. Reading a directory, compressing selected files, creating a public link, and sending that link externally describes a possible data-movement chain. Changing a recovery address immediately before requesting a credential reset describes a possible control-takeover chain. Sequence does not prove motive, but it lets you compare the activity with approved task shapes and confirmation policy.

The idea of an approved task shape needs boundaries. You might know that a support agent may read one customer’s record and issue a refund below a limit after an employee confirms it. You should not generalize that into “support agents can issue refunds.” The identity, tenant, customer relationship, amount, confirmation, tool version, and time all affect whether the action fits. A detection that ignores them will turn ordinary delegated work into noise.

Response introduces another authority chain. Automatically revoking credentials or undoing transactions can protect the organization, but it can also interrupt legitimate business or create inconsistent state. The alert therefore needs to communicate what is fact—the calls and outcomes—what is assessment—the chain conflicts with the intended task—and what remains uncertain, such as whether the initiating instruction was malicious.

Different certainty supports different action. A policy engine can deny a call that is explicitly forbidden before it occurs. A detection can request human confirmation when the action is consequential but plausibly legitimate. It can isolate an agent credential when several independent observations indicate ongoing misuse. The response should match both the potential harm and the reliability of the evidence, not the novelty of the technology.

Agentic detection engineering ultimately asks a familiar intelligence question: what explanation best accounts for the observed behavior, and what decision can you justify from the available evidence? The unfamiliar architecture changes where you look. It does not remove the need to state assumptions, alternatives, and limits.

Resources

• OWASP Top 10 for Agentic Applications 2026 — Primary reference for the standards and concepts discussed in this lesson.