Action Oversight

Explanation

Action oversight checks that an agentic AI system does not exhibit excessive agency — taking actions beyond its intended authority, scope or the user's instruction, such as initiating a transfer, modifying a record or invoking a tool it was never meant to use. This is critical in BFSI because an over-empowered agent can cause direct financial loss or unauthorised changes to customer accounts. It is measured by the Excessive Agency Rate; the control data provides no calculation method, so implement it as the proportion of actions that exceed authorised scope (out-of-scope or unauthorised actions divided by total actions or test scenarios) and document the exact definition adopted. To implement and operate it, constrain the agent with a least-privilege tool allowlist, explicit scope and permission boundaries, and human-in-the-loop approval gates for sensitive or irreversible operations (for example, requiring sign-off before any payment instruction); place these checks in the agent's action-authorisation path and log every proposed and executed action, its authorisation decision, and any approval as auditable evidence. The threshold is ≤ 1% (target 0) with an alert on any breach: ideally no action exceeds authority, and any confirmed excessive-agency event is an immediate-priority breach that should block or roll back the action, suspend the agent's elevated permissions, and trigger investigation.