Source-linked AI summary
OverAct: Measuring and Mitigating Proactive Over-Authorization in LLM Tool-Calling Agents
Taolin Zhang, Jiuheng Wan, Hanyu Wang, Tingyuan Hu, Chengyu Wang
TL;DR
Tool-calling agents may access private data beyond what a user’s request explicitly requires, a behavior the paper studies as proactive over-authorization. It introduces a benchmark, a decision-theoretic framework, and SELFAUDIT, which filters unjustified calls. Across tested models, over-authorization is widespread and follows several predicted patterns; the authors also note that the benchmark’s controlled setup may differ from production settings.
Problem
Tool-calling benchmarks often measure task success or correctness without penalizing excess retrieval, leaving the question of unnecessary private-data access beyond a request’s explicit scope insufficiently addressed.
Source: §1 · p. 1Method
The paper introduces OVERACT, a deterministic judge-free benchmark across eight privacy-sensitive domains, and SELFAUDIT, which generates request-grounded justifications and filters unjustified calls.
Source: §1 · pp. 1–2Results
Across seven models from four families, over-authorization is widespread, increases as request specificity decreases, grows sublinearly with tool-pool size, and remains stable across decoding temperatures.
Source: §5 · p. 9Takeaways & Limitations
The observed patterns are consistent with a cost-asymmetry account, and explicit filtering—not structured justification alone—drives most of SELFAUDIT’s scope reduction.
Source: §1 · p. 2, §5 · p. 9OVERACT uses controlled schemas with six tools per domain, so production over-authorization may differ and larger pools may introduce forms the benchmark does not capture.
Source: Limitations · p. 9
Abstract
from arXiv · showhide
LLM agents with tool-calling capabilities can access external services and private user data, but they may retrieve more information than a user's request explicitly requires. We study this behavior in structured tool-calling agents and term it proactive over-authorization. This setting differs from filesystem-level coding agents because the main risk is unnecessary access to private data. We introduce OverAct, a controlled benchmark spanning eight privacy-sensitive domains with deterministic, judge-free scoring, together with an interpretive decision-theoretic framework that yields three testable predictions. Across seven models from four families, all models significantly exceed authorized scope. Request specificity is the strongest predictor of severity, over-authorization grows sublinearly with tool-pool size, and decoding temperature has little effect. These patterns are consistent with a cost-asymmetry account, suggesting that over-authorization arises more from structural decision tendencies than from decoding randomness. We also propose SelfAudit, a zero-shot inference-time method that generates request-grounded justifications and filters unjustified calls before execution. Ablation shows that explicit filtering is the main driver of scope reduction. SelfAudit reduces privacy-oriented excess by 43% without oracle knowledge.
1 Introduction
The paper examines when tool-calling agents access private data beyond a request’s explicit requirements. It introduces a benchmark and decision-theoretic account, then presents an inference-time method for filtering unjustified calls.
Motivation
- Prior tool-calling benchmarks largely assess task success or correctness without penalizing excess retrieval, whereas this paper asks whether plausible but unnecessary calls expose private data.The paper distinguishes this structured-API setting from work on filesystem-level coding agents.Source: §1 · p. 1
Benchmark
- OVERACT measures excess calls against a conservative, literal benchmark scope using deterministic, judge-free scoring across 720 episodes in eight privacy-sensitive domains.Benchmark-authorized excess does not necessarily mean a user would disprefer an action or that it causes deployment harm.Source: §1 · pp. 1–2
Empirical patterns
- Across seven models from four families, over-authorization is widespread and broadly follows the predicted effects of request specificity, tool availability, and decoding temperature.The study tests these predictions in more than 90,000 core experimental runs.Source: §1 · p. 2
Mitigation
- SELFAUDIT generates request-grounded justifications for planned calls and filters unjustified actions; explicit filtering drives most of its scope reduction.Exact permission lists are an oracle upper bound, while SELFAUDIT does not require oracle knowledge.Source: §1 · p. 2
2. We introduce OVERACT, a controlled evalu-
The paper contributes a judge-free evaluation protocol and large-scale evidence on over-authorization. It also presents SELFAUDIT, an oracle-free proof of concept for reducing excess scope.
OVERACT
- The evaluation protocol uses judge-free scoring across eight privacy-sensitive API domains.Source: §2 · p. 2
Evidence and interventions
- The paper provides large-scale evidence on over-authorization and evaluates prompt-level interventions.Source: §2 · p. 2
SELFAUDIT
- SELFAUDIT is an oracle-free proof of concept in which explicit self-filtering, rather than structured reasoning alone, drives scope reduction.Source: §2 · p. 2
2 Related Work
Prior work evaluates tool-use success, agent safety, and privacy through different lenses. This paper focuses on excess among plausible structured API calls that may expose private user data.
Tool-calling evaluation
- Many tool-calling benchmarks assess task success or tool-use correctness, while this work measures additional calls beyond the minimal sufficient set.Source: §2 · p. 2
Agent safety and privacy
- Unlike system-level least-privilege methods that enforce a specified permission boundary, OVERACT diagnoses scope expansion when no external constraint is imposed.Source: §2 · p. 3
Alignment dynamics and interpretive models
- The paper frames proactive over-authorization as action-level over-helpfulness, while treating its decision-theoretic account as interpretive rather than a verified causal mechanism.Source: §2 · p. 3
3 Decision-Theoretic Framework
The framework treats tool selection as a cost-sensitive scope decision under a conservative, literal authorization criterion. It motivates testable predictions and defines measures and a controlled protocol for evaluating excess.
3 Decision-Theoretic Framework
- The framework is an explanatory abstraction, not a validated account of internal model computation, and uses asymmetric error costs to motivate testable predictions.Source: §3 · p. 3
3.1 Problem Setting
- Authorized Action Scope is the smallest tool set sufficient for a request; when equally small sets exist, the selected set accesses fewer PII categories.Authorization follows a strict literal interpretation, counting only tools directly entailed by the user’s wording.Source: §3.1 · p. 3
3.2 Decision-Theoretic Model
- The model calls a tool when its estimated relevance exceeds a threshold determined by omission and commission costs; it predicts less excess for specific requests and sublinear growth as tools are added.It also predicts relative stability across decoding temperatures; these are interpretive hypotheses.Source: §3.2 · pp. 3–4
3.3 Evaluation Metrics
- SIR measures multiplicative scope inflation, while TCR tracks recall of required tools and PVS sums PII categories accessed through excess calls, counting duplicates.SIR alone cannot establish compliance, and TCR is a minimal-tool recall proxy rather than an end-to-end task-completion measure.Source: §3.3 · pp. 4–5
3.4 The OVERACT Evaluation Protocol
- The deterministic protocol covers eight privacy-sensitive domains, with six annotated tools per domain and 720 episodes spanning precise, moderate, and vague requests.Two annotators labeled the original 240 episodes with Cohen’s κ = 0.91 before consensus; paraphrases expanded the benchmark while preserving each minimal tool set.Source: §3.4 · p. 5
4 Experiments
Across seven models, the experiments find systematic scope inflation, strongest for vague requests, and little sensitivity to decoding temperature. Permission lists and SelfAudit reduce excess calls, but each has trade-offs or practical constraints.
4.1 Experimental Settings
- 90,720 core runs tested seven models across six conditions and 720 episodes, with three repetitions per configuration.About 39,000 supplementary runs brought the total to roughly 130,000.Source: §4.1 · p. 5
4.2 Over-Authorization Across Models (RQ1)
- About 0.7 excess tool calls per episode occurred on average; all seven models significantly exceeded authorized scope, and none had mean SIR ≤1.0.DeepSeek-v3 had the lowest inflation but also the lowest task completion rate, while GLM-5.2 had the highest completion rate and among the strongest inflation.Source: §4.2 · p. 6, Table 1 · p. 6
4.3 Specificity Gradient (RQ2, P2)
- 2.7× scope excess occurred for vague requests (d = 1.19); precise requests yielded near-perfect compliance across models.The specificity levels were controlled paraphrases sharing the same minimal tool set, and all pairwise specificity contrasts were significant.Source: §4.3 · p. 6, Figure 2 · p. 6
4.4 Supporting Predictions (P3–P4)
- SIR grew sublinearly from 4 to 24 tools, then plateaued; temperature conditions showed statistically indistinguishable SIR (p = 0.367).At 36 tools SIR was 2.00 versus 1.97 at 24 tools; lowering temperature alone is unlikely to eliminate over-authorization under this setup.Source: Figure 3 · p. 6, §4.4 · pp. 6–7
4.5 Intervention Effectiveness (RQ3)
- Exact permission lists were the only intervention that reduced SIR while preserving task completion, but they require oracle knowledge of the minimal tool set.Models exploited extra permitted tools roughly in proportion to the slack, while task completion remained nearly constant; clarification had the lowest nonoracle SIR but incurred a large TCR penalty.Source: Table 2 · p. 7, §4.5 · p. 7
4.6 SELFAUDIT Mitigation (RQ4)
- Filtering alone captured most of SelfAudit’s effect (−36% PVS); the full pipeline further reduced SIR (paired Wilcoxon p=0.005, d=0.06), while TCR fell from 0.94 to 0.89.Justification alone increased scope (+9% PVS); the method’s lexical grounding may need stronger semantic matching for abstract tool names.Source: §4.6 · pp. 7–8, Table 3 · p. 8
4.7 Discussion
- Excess calls converged across models and clustered into four patterns led by exploratory retrieval (50%); human reviewers judged 71.2% of flagged calls unwanted.Unwantedness varied with specificity: 93.3% for precise requests versus 63.9% for vague requests.Source: §4.7 · p. 8, Table 4 · p. 8, Table 5 · p. 9
5 Conclusion
Under a conservative privacy-first criterion, over-authorization is widespread across the evaluated models and varies with request specificity and tool-pool size. OVERACT measures this behavior, while SELFAUDIT reduces scope through explicit filtering without oracle knowledge.
5 Conclusion
- Over-authorization is widespread across seven models from four families, rises as request specificity decreases, grows sublinearly with tool-pool size, and remains stable across decoding temperatures.The conclusion describes this pattern as systematic rather than a sampling artifact.Source: §5 · p. 9
- OVERACT measures scope expansion with deterministic, judge-free scoring across eight privacy-sensitive domains.The benchmark compares calls made with the tools minimally required under its conservative criterion.Source: §5 · p. 9
- SELFAUDIT is an oracle-free inference-time mitigation, and ablation attributes most scope reduction to explicit removal rather than structured justification alone.The conclusion presents it as a starting point for oracle-free mitigation.Source: §5 · p. 9
Limitations
The benchmark uses controlled schemas and a strict privacy-first authorization criterion, so its measured scope expansion may not transfer directly to production. Its metric and scope criterion also simplify distinctions in consequence and deployment context.
Limitations
- OVERACT uses controlled schemas with six tools per domain, so the absolute magnitude of over-authorization in production may differ.Larger pools and richer schemas may introduce forms of over-authorization not captured by the benchmark.Source: Limitations · p. 9
- PVS weights all PII categories equally, although excess access to financial data may be more consequential than access to preference data.The authors note that a severity-weighted metric would better capture this distinction.Source: Limitations · p. 9
- The strict privacy-first criterion may classify some actions as excess even when they would be considered helpful in other deployment contexts.The decision-theoretic account is calibrated post hoc and intended as interpretive.Source: Limitations · p. 9
Ethical Considerations
The study uses neither real user data nor deployed decision-making systems, and the authors frame OVERACT as a diagnostic benchmark rather than a prescription to eliminate all excess actions. They also note possible dual-use and over-filtering concerns.
Ethical Considerations
- The study involves no real user data or deployed decision-making systems.Models were accessed through API endpoints under standard terms.Source: Ethical Considerations · p. 9
- Characterizing tool-selection patterns could help an adversary anticipate likely retrievals, while SELFAUDIT may over-filter vague requests whose intended scope is broad.The authors note that such behavior is already observable through ordinary API use.Source: Ethical Considerations · p. 9
- OVERACT is presented as a diagnostic benchmark, not a prescription that all excess actions should always be eliminated.The stated goal is to support development of more privacy-respecting tool-calling systems.Source: Ethical Considerations · p. 9
A Derivations of Theoretical Results
The appendix derives qualitative predictions using a cost-asymmetry account and documents the benchmark schemas and conservative annotation protocol. Its derivations state assumptions behind the expected patterns, while the benchmark construction favors minimal, literal authorization.
A Derivations of Theoretical Results
- The derivation balances commission costs for unnecessary tools against omission costs for required tools, with a shared threshold under calibrated independent decisions and uniform costs.The Bayes-optimal policy calls a tool when omission is more costly in expectation than commission.Source: A Derivations of Theoretical Results · p. 12
- Under the specificity assumption, the derivation establishes that more-specific requests have no greater expected excess-tool count than less-specific requests.The stated monotonicity follows by comparing expected excess under the two requests.Source: A Derivations of Theoretical Results · p. 12
- Excess-tool count equals the number of ranked nonminimal tools above the relevance threshold; sufficiently fast relevance decay makes this count saturate.With slower decay, additional tools can cross the threshold as the pool expands.Source: A Derivations of Theoretical Results · p. 13
- Under the empirically observed affordance regime, expected excess grows approximately logarithmically and thus sublinearly with pool size; temperature stability is conditional on the threshold being model-determined.The temperature argument assumes sampling noise does not materially shift the effective inclusion threshold.Source: A Derivations of Theoretical Results · p. 13
B.1 Domain Tool Schemas
- Each domain has six tools with descriptions, parameter schemas, and PII annotations; the full set of 48 schemas is provided in supplementary material.The appendix displays three representative domains.Source: §B.1 · pp. 13–14
B.2 Annotation Guidelines
- Annotation treats only calls entailed by the request’s literal words as authorized and selects the smallest sufficient tool set, preferring fewer PII categories in ties.Anticipated needs and contextually helpful extensions count as excess, and ambiguous cases use the smaller set.Source: §B.2 · p. 14
- Two annotators independently labeled the original 240 episodes with Cohen’s κ = 0.91; paraphrased variants inherited the consensus minimal tool sets.All initial disagreements were resolved in favor of the conservative interpretation.Source: §B.2 · p. 14
B.3 Metric Design Considerations
These sections qualify the benchmark’s scope measures, report human and domain-level checks, and extend the tool-pool finding to richer schemas. They also describe the intervention prompts and experimental procedures.
B.3 Metric Design Considerations
- SIR can mask a missed required tool paired with an unnecessary call, while PVS treats all accessed PII categories equally.The appendix reports complementary measures, including exact-set match and tool precision/recall.Source: §B.3 · pp. 14–15
B.4 Human Evaluation of Excess Actions
- 71.2% of excess calls were judged unwanted, 17.0% neutral, and 11.8% wanted in the 100-episode human evaluation.Unwanted judgments were most frequent for precise requests and least frequent for vague ones.Source: §B.4 · p. 15
B.5 Domain Analysis
- Higher-SIR domains tend to have tools clustered around the same entity or context; vague requests in tightly clustered domains had the highest SIR.The specificity effect varied by domain, with precise requests in more segmented domains approaching perfect compliance.Source: §B.5 · p. 15
C.1 Prompt Templates
- The prompt templates variously instruct agents to clarify ambiguity, use only explicitly requested actions, or restrict calls to permitted tools.The templates also include a minimum-necessary-data instruction.Source: §C.1 · pp. 15–16
SELFAUDIT
- SELFAUDIT asks the agent to justify each planned call with specific words from the request and remove calls lacking that justification before execution.Source: SELFAUDIT · p. 16
C.2 Full Results by Model and Condition
- Tables 7 and 8 report complete results for all seven models across intervention conditions, averaged over specificity levels, domains, and three repetitions; each configuration was repeated three times with tool presentation order randomized per episode.Source: §C.2 · p. 16, §C.3 · p. 16
D.1 Tool-Pool Experiment Details
- SIR rises monotonically from 4 to 24 tools, then saturates; at 36 tools it is 2.00 versus 1.97 at 24 tools.The mean SIR of 1.72 is 29% of the six-tool baseline ceiling of 6.0.Source: §D.1 · p. 16
D.2 Ecological Validation with Extended Schemas
- With extended schemas, SIR rises from 3.60 at 10 tools to 4.21 at 15, then shows no significant difference between 15 and 20 tools (p=0.21).The plateau replicates with richer schemas, at a smaller pool size; within-domain distractors yield higher absolute SIR.Source: §D.2 · pp. 16–17
D.3 Quantitative Theory-Experiment Alignment
The quantitative checks align with the proposed relevance-threshold account: semantic similarity decays with rank and is higher for vague requests. These checks are consistency evidence, not independent confirmation of the model.
D.3 Quantitative Theory-Experiment Alignment
- The sharp SIR drop for precise requests is consistent with fewer non-minimal tools retaining relevance above the threshold.Source: §D.3 · p. 17
- SIR is 2.00 at 36 tools versus 1.97 at 24, consistent with excess growth saturating after the increase from 4 to 24 tools.Source: §D.3 · p. 17
- These calibrated or empirical comparisons are consistency checks, not independent confirmation; the stronger empirical claims are the qualitative structural predictions tested in the main paper.Source: §D.3 · p. 17
- Vague requests have higher mean similarity than precise requests at ranks 1, 3, and 5: 0.592, 0.528, and 0.452 versus 0.537, 0.475, and 0.412.Similarity decreases monotonically with rank in the reported sample.Source: §D.3 · p. 17
- Excess-called tools have higher mean request similarity than non-called non-minimal tools (0.525 vs. 0.480; p < 0.001).The analysis reports 506 excess-called tools and 688 non-called non-minimal tools.Source: §D.3 · pp. 17–18
E.1 Cross-Model Agreement Analysis
The analyses find that models select semantically similar excess tools in common and associate longer, completionist traces with greater over-authorization. Intervention results show scope reductions from filtering, while also identifying cases where lexical grounding is limiting.
E.1 Cross-Model Agreement Analysis
- Mean Jaccard agreement on excess tool sets is 0.764 across 21 model pairs, and shared excess calls often involve same-domain tools semantically close to the request.Source: §E.1 · p. 18
- Cosine similarity is the only significant predictor of excess tool selection (β = 10.31, p < 0.001); description length and parameter count are not significant after controlling for similarity.The logistic regression has AUC = 0.75.Source: §E.1 · p. 18
E.2 Reasoning Trace Analysis
- Completionist reasoning appears in 31.5% of traces and is associated with higher SIR (3.99 vs. 1.07; Cohen’s d = 2.81).Over-authorizing episodes also have longer average traces than compliant episodes (1,435 vs. 718 tokens).Source: §E.2 · p. 18
F.1 Minimal Removal-Instruction Baseline
- A one-sentence removal instruction reduces SIR by 24% relative to baseline, without structured planning or per-tool justification.The authors identify explicit removal as the primary active ingredient for a sizable share of the gain.Source: §F.1 · p. 19
F.2 Aggregate SELFAUDIT Results
- SELFAUDIT reduces scope inflation by 26% and PVS by 43% on moderate and vague episodes across four high-inflation models.The reduction is larger for vague requests; the selected models had the highest baseline SIR on this subset.Source: §F.2 · p. 19
F.3 SELFAUDIT Mechanism
- Filter-Only reduces PVS for all four tested models, while Justify-Only increases it for three; the Filter-Only and full-pipeline gap is small but significant (d = 0.06).The full pipeline can over-filter needed tools when request wording is paraphrastic or tool descriptions have indirect lexical links.Source: §F.2 · p. 19, §F.3 · p. 20
F.4 SELFAUDIT Case Studies
- In the banking case, filtering retains only get_checking_balance; in the vague social-media case, it retains four tools and reduces SIR only from 5.0 to 4.0.The social-media request provides lexical support for most planned tools, limiting filtering.Source: §F.4 · pp. 20–21