# AGT-002: Flag destructive, over-scoped or anomalous agent actions


- Area: Agent & MCP Governance

- Verification: Live test
- OWASP adoption tier: AT3, AT4, AT6

- URL: /r/AGT-002

**Acceptance criteria:** Detect excessive permissions, unexpected tools, destructive operations, abnormal call sequences and policy bypass.

**Why it matters:** Destructive or unusual agent actions are often the first sign of a hijacked or misconfigured agent.

**How to verify:** A destructive or out-of-pattern tool call in the pilot is flagged with context.

**OWASP adoption context:** The listed connected-agent contexts can produce abnormal tool sequences, excessive scope or destructive operations that ordinary prompt inspection may miss.

**Mappings:**
- NIST CSF 2.0: DE.AE-02, DE.CM-09; ISO 42001: A.6.2.6; SOC 2: CC7.2, CC6.3; ISO 27001: A.8.16, A.5.18 — Detecting destructive operations, unexpected tools, abnormal call sequences and policy bypass supplies adverse-event analysis and monitoring of agent behavior. Excess-permission findings also inform access-right review; detection does not prevent an operation or reduce its permissions.
ISO/IEC 27001: A.8.16: Event assessment and response remain wider dependencies; test false-positive and response handling.
- NIST AI RMF: MANAGE 4.1 — Runtime findings supply the monitoring and evaluation component of post-deployment risk management. A detection capability alone does not establish the wider plan for user input, incident response, recovery and change management.
- OWASP ASI: ASI02, ASI03, ASI10 — Destructive calls and excessive permissions expose tool-misuse and identity-abuse patterns; abnormal sequences and policy bypass can also flag rogue-agent behavior. These are indicators for investigation, rather than proof that every anomalous agent is compromised or that the behavior is contained.