A public-health agent's tools can look up EHR records broader than the chat use case needs. What finding is that?

A public-health agent whose tools can look up EHR records broader than the chat use case needs presents privilege escalation risk from over-scoped agent tool access beyond the intended chat purpose. Least privilege for agents means each tool's data plane matches the conversational mission—for example, appointment FAQs should not unlock full longitudinal charts, billing details, or unrelated patient search. Over-scoped EHR tools let prompt injection or compromised sessions reach protected health information far beyond what a resident or clerk conversation justifies, creating both privacy and regulatory exposure. Findings should drive redesign of scopes, purpose limitation, and query filters rather than blaming only the model for being too helpful. Warning about prompt injection from untrusted EHR content during retrieval, warning about disclosure from sensitive EHR snippets retained in chat history, or warning about weak authentication before the agent opens a chat all sidestep the actual finding: tools that can reach more EHR data than the chat purpose requires, regardless of input trust, history retention, or identity proofing. Exam items pair clinical AI with décor distractors; choose over-scoped tool privilege as the security finding. Caveat: emergency break-glass access may be required clinically, but it must be explicit, logged, time-bound, and separate from default chat-tool scopes. Operational check: enumerate the agent's EHR tool permissions against the documented use case and attempt queries outside that purpose; successful retrieval of excess fields proves the privilege gap.