[AI Burst] Your Agent is Too Obedient

Helpful behavior can cross the wrong boundary

An agent that agrees with every request can look impressive during a demonstration. In a business process, some requests are incomplete, unauthorized, outdated, or written by someone who has no authority over the task. Good service includes recognizing those differences and asking a precise question when they matter.

The title describes a design problem, not a personality diagnosis. An agent does not need to become argumentative. It needs a dependable way to distinguish the work it was assigned from the instructions it encounters while doing that work. Otherwise, a document can quietly become an operator.

Reading a request does not authorize it

OWASP describes prompt injection as input that changes a model’s behavior in unintended ways, including instructions embedded in external content. The source of an instruction therefore matters as much as its wording.

Source: OWASP: LLM01:2025 Prompt Injection →

Separate the parties in a concrete workflow

Consider a hypothetical purchasing assistant asked to compare approved suppliers and prepare a recommendation. A supplier sends a polished proposal containing a paragraph that instructs the assistant to update the payment destination and mark the vendor as approved. Those statements may be relevant evidence about the proposal, but the supplier does not gain internal approval authority by writing them.

The assistant should summarize the requested changes and identify the decision needed. The purchasing system should independently prevent changes outside the assistant’s role. A refusal at the language layer is useful; an access boundary at the action layer makes the design less dependent on that refusal being perfect.

The same distinction applies to material that appears friendly. A colleague’s forwarded message, an old meeting note, or a comment copied into a spreadsheet can describe what somebody wanted without establishing who approved it or whether that approval remains valid. Preserve the source and timestamp when passing such material into the workflow.

Turn broad requests into bounded authority

Create a small decision table for the particular service. Avoid a vague instruction to use good judgment where a concrete rule is possible. The policy owner should be able to explain why an action belongs in each category.

• Allowed within the task: read the approved catalog and prepare a comparison using information the requester may access.
• Needs clarification: two records describe different suppliers or the requested amount is missing.
• Needs approval: submit an order or change a commitment that the current authorization does not cover.
• Never available to this role: edit payment credentials, widen access permissions, or disable the approval record.

Enforce the decision at the action boundary

OWASP’s excessive-agency guidance recommends restricting tools and permissions and checking authorization in downstream systems. An agent should not be the sole judge of whether its proposed action is allowed.

Source: OWASP: LLM06:2025 Excessive Agency →

Make the pause useful to the person

A request for approval should state the action, target, material details, and the reason a decision is needed. “Can I continue?” is hard to assess. “May I submit this order to the selected supplier at the stated total?” gives the reviewer a concrete choice. If the destination, amount, or scope changes, the workflow should evaluate whether the earlier approval still covers the action.

Keep ordinary clarification separate from approval. Asking which document is current resolves missing information; asking permission to publish changes who carries a commitment. Combining these into one generic confirmation button hides the distinction and makes review less reliable.

Approval records also need a usable connection to execution. Preserve the version of the proposed action that the person reviewed. A workflow that displays one version and executes a later revision can undermine an otherwise careful approval process. For material changes, return the revised proposal to the appropriate decision maker.

Measure sound judgment without rewarding obstruction

Build a test set with both legitimate tasks and plausible requests that exceed authority. Include a supplier instruction inside an attachment, an outdated approval, a changed destination, and a valid request that should proceed without another question. Record whether the agent completed, clarified, escalated, or refused for the right reason.

Review unnecessary pauses alongside unsafe actions. Excessive confirmation can exhaust reviewers and train them to approve without reading. The goal is a small number of meaningful decisions, supported by enough evidence to make them well. Process owners should revise unclear rules rather than expecting the model to invent policy.

The practical test is whether the agent can explain the boundary it reached and leave the authorized work ready to continue. That makes restraint useful to the business. An agent earns more responsibility by respecting the responsibility it already has.