OverAct: Measuring and Mitigating Proactive Over-Authorization in LLM Tool-Calling Agents

2026-10-01

AI Summary

This study addresses the security vulnerability wherein tool-calling agents powered by large language models (LLMs) proactively exceed their authorized scope to access private data. Methodologically, it introduces OverAct, a judge-free deterministic benchmark, alongside a decision-theoretic framework to elucidate the structural causes of over-authorization. Furthermore, it designs SelfAudit, a zero-shot inference-time filtering mechanism that enforces permission constraints through self-auditing prompt engineering. Experimental results validate theoretical predictions regarding request specificity and demonstrate that SelfAudit reduces unauthorized privacy access by 43%, offering an effective solution for enhancing the security of LLM-based agents.

Abstract

LLM agents with tool-calling capabilities can access external services and private user data, but they may retrieve more information than a user's request explicitly requires. We study this behavior in structured tool-calling agents and term it proactive over-authorization. This setting differs from filesystem-level coding agents because the main risk is unnecessary access to private data. We introduce OverAct, a controlled benchmark spanning eight privacy-sensitive domains with deterministic, judge-free scoring, together with an interpretive decision-theoretic framework that yields three testable predictions. Across seven models from four families, all models significantly exceed authorized scope. Request specificity is the strongest predictor of severity, over-authorization grows sublinearly with tool-pool size, and decoding temperature has little effect. These patterns are consistent with a cost-asymmetry account, suggesting that over-authorization arises more from structural decision tendencies than from decoding randomness. We also propose SelfAudit, a zero-shot inference-time method that generates request-grounded justifications and filters unjustified calls before execution. Ablation shows that explicit filtering is the main driver of scope reduction. SelfAudit reduces privacy-oriented excess by 43% without oracle knowledge.

Problem

• LLM agents
• tool-calling
• proactive over-authorization
• privacy risk
• over-access

Innovation

• Proactive Over-Authorization
• Tool-Calling Agents
• OverAct Benchmark
• Decision-Theoretic Framework
• SelfAudit