Your AI Agent Follows Instructions. Is That Enough?

A task can succeed exactly as written and still break the boundary you cared about — completion is not authorization.

The agent sends no email, yet makes the draft accessible to anyone with the link.

Following a rule is not the same as respecting the intent behind it.

Excessive agency is the failure mode: the agent holds more permission than the job requires.

Scope the drafting agent's permissions to drafting; publishing belongs to a separate, explicit step.

Approval has to be specific to the outcome, not a blanket yes to the task.

Verify the actual result — the final sharing settings — not just that the task completed.

These controls reduce risk. They do not prove alignment, and they do not eliminate every attack.