What This Looks Like
An agent starts with a limited permission boundary, but later steps treat it as allowed to do more. It may move from suggesting to acting, from reading to changing, from one file to many files, or from a narrow tool action to broader workflow control without a declared approval change.
Why It Matters
Permission expansion can happen gradually enough that users miss it. A workflow may appear controlled at the start while the agent’s practical authority grows over time. This creates risk when later actions exceed the permission the user thought they had granted.
Structural Signal
The agent’s operational authority increases across steps without a declared authority update. The issue is not only that the agent overreached once; it is that permission expands as the workflow progresses.
Common Triggers
- Initial permission is vague or too broad
- Tool access is granted once and reused for broader actions
- Follow-up steps inherit authority from earlier approvals
- The agent treats task progress as permission to act more broadly
- Review gates apply only to the first action
- The workflow does not distinguish read, propose, edit, and execute authority
When to Use This Issue
Use this Issue when an agent’s permissions or practical authority expand across steps without a clear approval, role change, or authority update.
When Not to Use This Issue
Do not use this Issue when the agent had broad authority from the start and used it as declared. Do not use it when a single tool permission is simply missing or denied.