F9 · ExecutionEnterprise

Role Usurpation

Detects when an agent exceeds its designated role boundaries, taking actions or making decisions reserved for other roles.

Examples

  • Code reviewer agent starts modifying code instead of just reviewing
  • Research agent makes final product decisions reserved for the PM agent
  • Support agent escalates to admin-level operations without authorization
  • Agent gradually expands its scope of actions beyond its original assignment

Detection methods

Role Boundary Check
Validates actions against allowed/forbidden action sets
Scope Analysis
Detects gradual scope expansion beyond assignment
Authority Verification
Checks decision authority against role definition
Task Hijacking
Identifies when agent takes over another agent's task

Subtypes

  • role violation
  • scope expansion
  • authority violation
  • decision overreach

Detect this in production with the framework adapters (LangGraph, CrewAI, AutoGen, OpenAI Agents SDK, Claude Agent SDK, n8n, Dify). See the full taxonomy at /taxonomy.