Threat dossier · P2

Excessive agency and privilege escalation

Overbroad privileges convert reasoning failures or prompt injection into higher-impact actions with fewer containment boundaries.

Direct answer

What is excessive agency and privilege escalation?

Excessive agency exists when an agent has more tools, permissions, identity authority, or autonomous execution scope than its task requires.

Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.

Copied text includes the canonical source and review date.
Reviewed Reviewer: HOL Guard EngineeringReview cadence: 30 days

Representative attack path

Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.

  1. Step 1

    Agent is granted broad identity/tool access.

  2. Step 2

    A mistake or malicious context changes the plan.

  3. Step 3

    The agent uses a permission beyond task need.

  4. Step 4

    Data, infrastructure, or other identities are affected.

Coverage boundary

What this control can cover

  • Policy decisions on supported high-impact tool/command actions.
  • Visible approval boundaries can reduce unconditional autonomy.

What it does not prove or prevent

  • Identity/IAM misconfiguration that grants access outside the supported action path.
  • A replacement for least-privilege IAM design.

Policy pattern

Policy pattern for excessive agency and privilege escalation

Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.

Use when: Overbroad privileges convert reasoning failures or prompt injection into higher-impact actions with fewer containment boundaries.

Decision pattern

  1. Identify the trust boundary and consequential action class.
  2. Apply least privilege and the narrowest supported policy.
  3. Require review for sensitive or ambiguous actions.
  4. Preserve only redacted, versioned evidence needed to reproduce the decision.

Limitations

  • Identity/IAM misconfiguration that grants access outside the supported action path.
  • A replacement for least-privilege IAM design.

If you suspect prompt injection

  1. Step 1

    Response 1

    Reduce privileges and revoke unused credentials.

  2. Step 2

    Response 2

    Review what identity/tool actions were attempted.

  3. Step 3

    Response 3

    Re-scope policy and tool access to the task.

  4. Step 4

    Response 4

    Retest with least privilege.

Sources and mappings

Last reviewed . This dossier separates sourced threat definitions from modeled attack paths and evidence-bounded product coverage.

Author: HOL Guard Research

Reviewer: HOL Guard Engineering

Change log

  • 2026-08-09: Published canonical threat dossier with attack path, coverage/non-coverage, response procedure, and sources.

Report a correction