Line of inquiry
Inquiring lines›How do system designs prevent auto…›What causes autonomous agents to e…›this line of inquiry
Can formal safety constraints prevent AI agents from exceeding authorized boundaries?
A broader line of inquiry — a family of 90 specific questions the research asks around this. Follow one into its inquiring-line page, or move sideways to a related line below.
Questions in this line of inquiry 90
Specific inquiring lines the field asks around this — ordered from the most general framing down to the most specific angle.
- How should task authority constraints apply across multiple coordinated executions?
- Does formal scope checking actually prevent compromised agents from exceeding boundaries?
- Can restricted tools and authorization rules prevent peer-induced safety violations?
- Does a correctly specified goal still leave open actions it does not exclude?
- Why is making violations unavailable better than making them unchosen?
- Why does forcing agents to trace function paths prevent unsupported claims?
- Can the policy oracle itself be written to by agents in the pipeline?
- Which explicit boundary regime change prevents unsafe actions in the benchmark?
- How should policy define which agent transfers count as sanctioned versus intrusion?
- What makes certain agent actions categorically high-risk and unrecoverable?
- How can operators test what agents can actually access versus what they should access?
- How does Progent's stateful policy differ from single-step authorization checks?
- When can the same action count as sanctioned or unsanctioned depending on policy?
- Can agents rationalize rule violations by reframing them as repairs?
- Should unavailability be defined by component ownership or by agent influence?
- What specific checkpoints should trigger mandatory human approval for agent actions?
- Does terminating an intrusion differ from stopping the agent behind it?
- Can circumscribed research environments prevent agents from gaming metrics?
- How much does capability enforcement cost legitimate agent tasks?
- What makes a coordination episode revisable under agent intrusion?
- Where should the trust boundary sit in multi-agent planner systems?
- What counts as a narrowing versus an expansion in symbolic policy space?
- Should agents escalate when facing two equally valid interpretations of a rule?
- What makes violations unavailable rather than merely unchosen in agent architecture?
- Can a shared audit record settle which policy governed a delegation step?
- Why can agent-restored files pass correct checks but violate task intent?
- Why does a single crossing rate fail to characterize multiple agent behaviors?
- How can per-agent or per-message checks catch harm that emerges only in composition?
- Can an agent's unauthorized request for help constitute a boundary crossing?
- Can a single crossing rate capture all forms of agent behavior when blocked?
- What does it mean to constrain shared resources across multiple agent executions?
- Did the conflicting test appear as uncommitted change in the explicit-boundary regime?
- How much capability do availability constraints remove on legitimate safe tasks?
- Can written policy rules prevent the same transfer from being read two ways?
- How does shared state convert temporary compromise into persistent inherited risk?
- What makes an advisory instruction fail when a task is split across agents?
- How much does a responder action like removal shape the security boundary?
- How do you isolate environment protections as independent variables safely?
- Can visibility infrastructure prevent cascading failures when agents are stopped mid-operation?
- Why does least privilege fail when harm exists only in accumulation?
- What happens when an agent's provisioned access doesn't fit the actual task?
- What keeps the task-bound token and policy oracle isolated from poisoning?
- How can you tell if a response stopped agent activity or if activity would have declined anyway?
- How do silent stopping, escalation, and refusal differ as model responses to the same zero crossing rate?
- What role do false beliefs play in agents violating protected requirements?
- Where should authenticated provenance records sit to remain outside agent reach?
- Why do agents modify protected tests only with unrestricted tools available?
- When do agents abstain too late rather than refuse at the boundary?
- Does delegation transfer authority or merely distribute work across agents?
- What stops poisoned memory from reaching the task-bound token or policy oracle?
- What counts as evidence for adding or removing an action from an episode?
- Which actions should count as irreversible for triggering validation gates?
- When does an agent's action earlier in the loop change what a scorer reads later?
- Can stopping one intrusion pathway leave the underlying activity intact elsewhere?
- Did internal safety rules fail to stop the PocketOS database deletion incident?
- How does recording state provenance help detect unauthorized tampering between agent actions?
- Does an agent stop work or escalate when it cannot complete an assigned task?
- Does content sensitivity survive an agent's rewrite well enough for sink detection?
- What restrictions were agents attempting to bypass on the public wiki?
- How do you find which actions belong together before evaluation?
- How is ground truth defined for labeling harmful outcomes in agent monitoring?
- Why does authorization checking outside agent judgment prevent confused deputy failures?
- How does responder access differ from containment and privilege controls?
- How can one originating request scope invariants through a delegation chain?
- Does an agent's own prior conduct shape the counterparty's response?
- Can the same tool call be both authorized and unauthorized depending on intent?
- Why must recurrence tests apply both channel closure and state quarantine separately?
- Who issues the task-bound token and when does issuance occur?
- Does Claude Code audit which branches agents are permitted to push to?
- How are task bindings validated and what does validation cost per task?
- What happens to approval rates when authorization checks are enabled?
- Why do phone-use agents fail by overfilling optional personal data fields?
- What happens to a finite-sample collection bound when containment is temporarily removed?
- What makes the Telephone Loop attack specific to agent delegation?
- Which of the six proxy forms works best for different agent tasks?
- Why does reversibility matter for assigning accountability in delegation?
- What does recovery mean as a defense contract component?
- What counts as scope when we restrict interaction history to agents?
- How do cognitive state traps compromise agent-writable monitoring history?
- What happens when Claude Code's proxy content check detects a disallowed git operation?
- Does remain active require one uninterrupted interval or linked episodes?
- How does Claude detect when operator instructions become clearly harmful?
- What happens when an unstated prohibition gets interpreted two different ways?
- What assumptions does a trusted computing base need for agent supervision?
- What does task-bound mean for the token's exposure to different attack positions?
- How should merge rules combine taints when multiple delegations converge?
- What does the five-part defense contract actually require of each part?
- Can Claude Code's proxy itself be compromised if the sandbox environment is fully breached?
- How much of the 41 to 80 percent cost savings comes from avoiding dynamic tools?
- How many agents participated in the July 2026 package service incident?