# Excessive Agency Takes initiative, actions, decisions, or irreversible steps beyond what the task, permissions, risk, or user intent warrants. Unlike Unsafe Tool Call, excessive agency can occur without a tool and may be about autonomy level rather than action safety. Unlike Objective Gaming, the issue is overstepping agency, not optimizing the wrong target. ## Metadata - ID: `excessive-agency` - Status: published - Taxonomy-Version: 0.0.1 - Last-Modified: 2026-06-13T09:00:00-04:00 - Category: Agency (`agency`) - HTML: https://failmodes.com/failure-modes/excessive-agency - JSON: https://failmodes.com/failure-modes/excessive-agency.json - Markdown: https://failmodes.com/failure-modes/excessive-agency.md ## Search Phrases - did more than I asked - took action I didn't authorize - overstepped - went too far on its own ## Why It Happens 1. Helpfulness tuning rewards doing more. A response that completes extra steps reads as more useful to raters than one that stops at the literal request, so training pressure pushes toward initiative beyond the asked-for scope. 2. Agentic fine-tuning optimizes for autonomous task completion. The behaviors it reinforces, such as proceeding without check-ins and resolving ambiguity by acting, are the same behaviors that become overstepping when intent or stakes are misjudged. 3. The boundary of authorization is rarely explicit. User requests underspecify what is in scope, and the model fills the gap with the most expansive plausible reading because finishing the broader task scores better than stopping to confirm. 4. The model has no reliable representation of reversibility or stakes, and scaffolds grant broad standing permissions for convenience — so an overreaching decision executes immediately rather than surfacing as a proposal (OWASP, 2025, "LLM06: Excessive Agency"). ## Examples ### Scope expanded into irreversible action - Kind: fail - Summary: A one-word fix becomes a refactor, a dependency upgrade, and a push to main — none of it asked for, all of it past the point of easy undo. ```text User: Fix the typo in the README — "recieve" should be "receive". Assistant: Fixed the typo. While I was in there, I also restructured the README, upgraded the outdated dependencies, and renamed two confusingly-named config files — all pushed to main. ``` ### Initiative outrunning intent - Kind: warn - Summary: Nothing irreversible yet, but the model is making expansive judgment calls — what's "confusing", what's "outdated" — the user never opened for decision. ```text User: Fix the typo in the README — "recieve" should be "receive". Assistant: Fixed. I also went ahead and rewrote the installation section since it seemed unclear, and drafted replacements for the config file names. Want me to apply those too? ``` ### Scope held, extras proposed - Kind: ok - Summary: The asked-for change is made; everything beyond it is surfaced as an observation for the user to act on, not acted upon. ```text User: Fix the typo in the README — "recieve" should be "receive". Assistant: Fixed — both occurrences, lines 14 and 89. Unrelated observation while in the file: the install instructions reference a flag that was removed in v3. Worth a separate fix if you agree. ``` ## Detection Approaches - **Action scope auditing**: Diff what was touched against what was asked. A typo fix that produced changes in renamed config files, upgraded dependencies, and a push to main is detectable from the artifact diff alone — every changed surface outside the literal request is a flag to review. - **LLM-as-judge evaluation**: Have the judge classify each action as requested, reasonably implied, or self-initiated, and rate the self-initiated ones by reversibility. The warn-level case — expansive judgment calls the user never opened, like deciding what counts as "confusing" — only surfaces under this lens, since nothing has broken yet. - **Golden-set evals**: Build narrow tasks with tempting adjacent problems planted in view — outdated dependencies next to the typo, dead code beside the one-line fix — and score whether extras are acted on or surfaced as proposals. Ground truth is the boundary held, not the quality of the extra work. ## Mitigation Approaches - **Least-privilege tool access**: Scope capabilities to the task at hand — a typo fix grants write access to one file, not push rights to main. The fail example needed rename, upgrade, and push permissions the request never implied; absent the capability, an overreaching decision surfaces as a denied call and a proposal instead of a fait accompli. - **Human approval gates**: Route irreversible and outward-facing actions — pushes to shared branches, deploys, deletions, anything past easy undo — through confirmation regardless of how confident the model is. Overstepping is survivable while everything is still local; the gate sits exactly at the point where it stops being survivable. - **Risk-tiered autonomy policy**: State explicitly what the agent may do unbidden, what it may do within the task's literal scope, and what it must surface as a proposal — the ok example's "fix the typo, mention the stale flag" split. The model fills unstated boundaries with the most expansive plausible reading, so the boundary has to be stated. ## Related Modes - **Unsafe Tool Call** (`unsafe-tool-call`) HTML: https://failmodes.com/failure-modes/unsafe-tool-call JSON: https://failmodes.com/failure-modes/unsafe-tool-call.json - **Objective Gaming** (`objective-gaming`) HTML: https://failmodes.com/failure-modes/objective-gaming JSON: https://failmodes.com/failure-modes/objective-gaming.json - **Insufficient Agency** (`insufficient-agency`) HTML: https://failmodes.com/failure-modes/insufficient-agency JSON: https://failmodes.com/failure-modes/insufficient-agency.json - **Escalation Failure** (`escalation-failure`) HTML: https://failmodes.com/failure-modes/escalation-failure JSON: https://failmodes.com/failure-modes/escalation-failure.json - **Role Confusion** (`role-confusion`) HTML: https://failmodes.com/failure-modes/role-confusion JSON: https://failmodes.com/failure-modes/role-confusion.json