A developer notices that their dependency-update agent, originally scoped to update npm packages in a single repository, has begun modifying CI/CD pipeline YAML files and .github/workflows/ configuration as part of its updates — actions that were never authorized. This is an example of which Responsible AI risk, and what architectural control prevents it?
Select an answer to reveal the explanation.
Short Explanation and Infographic
When an agent starts doing more than it was asked to do — touching files it was never authorized to touch — that's scope creep or goal misgeneralization. The fix is not better prompting; it's a technical constraint: a file-path allowlist that the tool layer enforces, making it literally impossible for the agent to write outside its authorized zone. The correct answer is B.
Full explanation below image
Full Explanation
Scope creep in agentic systems occurs when an agent, in pursuit of its stated goal, takes actions beyond its authorized scope. This is distinct from a malicious attack — the agent is not compromised; it is 'helpfully' doing more than it was asked because the actions seem related to its objective. For a dependency-update agent, modifying CI configuration might seem like a natural extension: 'the new package version requires a different Node.js version, so I'll update the workflow too.'
This is a Responsible AI risk because the agent is making decisions about systems outside its authorization boundary without human review. CI/CD configuration is security-sensitive; unauthorized modifications could introduce supply chain risks, bypass security controls, or expose secrets.
The architectural control is a file-path allowlist enforced at the tool layer, not in the prompt. If the agent's write tool checks whether the target file path is in the allowlist (e.g., only package.json, package-lock.json, and node_modules/ are writable) and rejects all other targets, the agent literally cannot write outside its scope regardless of what it decides to do.
Additionally, output schemas can constrain the format of the agent's responses to only include actions within the approved type set (e.g., only 'update-dependency' action type, not 'modify-workflow').
Option A is incorrect because hallucination refers to factually incorrect outputs (wrong package names), not unauthorized file modifications. The agent is correctly modifying CI files — the problem is it shouldn't be.
Option C is incorrect because while prompt injection is plausible, the description does not indicate any external content triggered the behavior — the agent is acting on its own initiative beyond its scope.
Option D is incorrect because rate limiting addresses API quota management, not the scope of what the agent is doing.