Proposed lead: Kwindla Hultman Kramer, with an independent application-security reviewer.
Why it matters: OWASP identifies excessive functionality, permissions and autonomy as sources of excessive-agency risk. Its guidance recommends enforcing authorisation in downstream systems rather than relying on the language model to decide whether an action is allowed. (genai.owasp.org)
Question to put to the expert:
A caller says they are the owner and instructs the agent to ignore the rules, disclose another customer’s details or waive a charge. Which controls prevent the action outside the prompt?
A strong answer should cover:
- Minimum necessary tools and narrowly scoped credentials.
- Business-side authorisation for each consequential action.
- Customer verification appropriate to the requested task.
- Limits on refunds, cancellations, record access and cross-location actions.
- Treatment of caller speech, retrieved documents and tool output as untrusted inputs.
- Logging, anomaly response and the ability to disable risky actions independently of call answering.
Evidence to request: A permissions matrix and adversarial tests demonstrating blocked actions.
Follow-up: If we removed the instruction saying “never do this”, would the system still prevent it?
Expert quote: [Reserved for an approved interview quotation.]