Threat dossier · P2
Excessive agency and privilege escalation
Overbroad privileges convert reasoning failures or prompt injection into higher-impact actions with fewer containment boundaries.
Direct answer
What is excessive agency and privilege escalation?
Excessive agency exists when an agent has more tools, permissions, identity authority, or autonomous execution scope than its task requires.
Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.
Representative attack path
Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.
Step 1
Agent is granted broad identity/tool access.
Step 2
A mistake or malicious context changes the plan.
Step 3
The agent uses a permission beyond task need.
Step 4
Data, infrastructure, or other identities are affected.
Coverage boundary
What this control can cover
- Policy decisions on supported high-impact tool/command actions.
- Visible approval boundaries can reduce unconditional autonomy.
What it does not prove or prevent
- Identity/IAM misconfiguration that grants access outside the supported action path.
- A replacement for least-privilege IAM design.
Policy pattern
Policy pattern for excessive agency and privilege escalation
Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.
Use when: Overbroad privileges convert reasoning failures or prompt injection into higher-impact actions with fewer containment boundaries.
Decision pattern
- Identify the trust boundary and consequential action class.
- Apply least privilege and the narrowest supported policy.
- Require review for sensitive or ambiguous actions.
- Preserve only redacted, versioned evidence needed to reproduce the decision.
Limitations
- Identity/IAM misconfiguration that grants access outside the supported action path.
- A replacement for least-privilege IAM design.
If you suspect prompt injection
Step 1
Response 1
Reduce privileges and revoke unused credentials.
Step 2
Response 2
Review what identity/tool actions were attempted.
Step 3
Response 3
Re-scope policy and tool access to the task.
Step 4
Response 4
Retest with least privilege.