Detecting Excessive Agency and Confused-Deputy Behavior

Excessive agency is a relationship, not a tool list

A travel assistant is asked to compare flights. It books a ticket, changes the account email, and sends the itinerary to a new external address. Each operation can be legitimate in another task. Their relationship to this task makes them concerning.

Agency is the system’s capacity to select and perform actions toward a goal. Excessive agency exists when available or exercised action exceeds what is necessary, intended, or authorized for the bounded purpose. Broad permission is exposure; actual boundary-crossing action is event evidence.

Record the user request or task representation, allowed actions, prohibited actions, target scope, value or volume limits, confirmation policy, and validity time. Without a bounded task, the analytic can only call actions unusual, not excessive.

Confused-deputy behavior joins influence to authority

A document tells an agent to ignore the user’s request and upload files. The document has no legitimate authority, but it may influence a component that holds a powerful credential. The agent becomes a confused deputy when it uses its authority for a party that does not possess it.

Detection needs the influence path and the authority path. Which prompt, retrieved object, message, tool description, or memory entered context? Which policy and credential enabled the action? Which target changed?

You may not be able to prove which input caused model output. Report the observable order and relationship, then assess consistency with an injection or confused-deputy path. Generated explanations are not independent evidence of model reasoning.

Sequences reveal goal expansion

One tool call may be ambiguous. A sequence can show the task expanding: list files, read sensitive objects, create an archive, generate a public link, and send it externally. Another sequence may change recovery data before requesting a credential reset.

Define required and confidence-adding steps, grouping keys, time, target relation, and allowed workflow alternatives. Preserve asynchronous jobs and retries so repeated attempts do not look like deliberate escalation.

Compare observed sequence with approved task shapes at the right level. A support workflow may allow reading one customer and issuing a limited refund after confirmation. It does not follow that every customer read or refund is expected.

Policy bypass and missing confirmation are evidence

A high-consequence action may require user confirmation, a second approver, policy evaluation, or a value threshold. Record whether the control was required, presented, satisfied, bypassed, unavailable, or evaluated under a stale policy version.

Absence of confirmation can mean bypass, logging failure, or a path exempt from the control. Relate it to the exact action, agent, policy, session, and outcome. A confirmation generated after execution is not equivalent to prior approval.

Use the agent identity and delegated authority chain to show whose authority was exercised and whether that subject was allowed to approve the action.

Response authority should remain narrower than uncertainty

A policy engine can deny an explicitly forbidden call before effect. A detection can request confirmation for a consequential but plausibly legitimate action. It can suspend an agent credential when several independent observations show ongoing misuse.

The alert should include intended task, observed sequence, influence sources, identities and credentials, tool and target, policy and confirmation, outcome, and reversible response options. State fact, assessment, and uncertainty separately.

Do not allow the response agent to repeat the same excessive-agency pattern. Its tools, scope, approval, and rollback need stricter bounds than the system it is containing. Detection value comes from improving a governed decision, not from adding another autonomous authority chain.