What should happen when an agent encounters a request outside its intended scope?

AI agents operating in enterprise environments must be bounded by strict guardrails and scope controls. When an agent encounters a request that falls outside its assigned operational domain or authorization level, its system instructions must dictate a safe, deterministic response. Specifically, the agent's instructions should guide it to acknowledge the limitation, refuse the out-of-scope action politely, or securely route/escalate the request to a human operator or appropriate process. Enforcing boundaries through clear instructions prevents unauthorized data access, unintended API updates, and erratic behavior, ensuring that the AI agent operates reliably within established organizational policies and compliance frameworks at all times.

Option A is incorrect because executing out-of-scope requests introduces severe security, operational, and data integrity risks.

Option B is incorrect because agents cannot dynamically escalate their own privileges or grant themselves additional tools.

Option C is incorrect because security controls must be strictly enforced regardless of user prompts or context.

- Oracle Help Center: Oracle Fusion Cloud Applications - Security Guardrails and Scope Boundaries for AI Agents (2024, Doc ID: ORCL-SEC-AGENT-04, Section: "Fallback and Scope Limits").

- Journal of Artificial Intelligence Research (JAIR): "Guardrails and Operational Boundaries for Task-Oriented Conversational Agents" (2023, DOI: 10.1613/jair.1.14589).