What's this about?
AI agents are becoming a primary interface to email, files, payments and personal data. People without software backgrounds need understandable, reusable ways to say what an agent may do. This paper studies whether policies those users write themselves actually constrain the agent.
What is an "overreach" as distinct from an attack?
An attack is someone else making your agent do something. Overreach is your own agent doing more than you meant, with no adversary involved — sending the email you only wanted drafted, paying the invoice you wanted reviewed, deleting the files you wanted archived. It is the failure mode that will affect the most people, and it is entirely a permissions-expression problem: the user had an intent, the system had a capability, and nothing mapped one onto the other.
Why does this matter to you?
- It is the usability half of the governance papers running through this month — the five-primitives paper handles enterprise identity, this one handles the person at home.
- Studying whether written policies *work*, rather than whether users like writing them, is the right question and a rare one.
- Whatever this finds constrains any consumer-facing agent permission UI you might design.