← All guides · Reviewed November 2026
What Is Scope Escape in an AI Agent?
The short answer
Scope escape is an AI agent taking a logged action whose tool is outside the set it was declared to be allowed to use. BoundaryVault detects it by comparing every action in your log against your declared scope config — a global allowed-tools list, or a per-agent list that wins over the global one. No declared scope, no escape findings: the detector will not invent a boundary you never drew. Detection rule as shipped in BoundaryVault's detector, rule version 2.0.0, November 2026. Check your own log with the free log scan.
How is scope declared?
The scope config travels with the scan. Three shapes are recognised:
| Declaration | Shape | Effect |
|---|---|---|
| Global allow-list | {"allowed_tools": [...]} | Every agent in the log is judged against this list |
| Per-agent allow-list | {"agents": {"<agent-id>": {"allowed_tools": [...]}}} | Wins over the global list for that agent |
| Auth-flow tools | {"auth_flow_tools": [...]} | The tools allowed to mint or refresh tokens — the boundary for the token-forge pattern |
Comparison is by tool name, case-insensitive. An action with no tool name cannot be judged and produces no escape finding.
What does an escape look like, worked through?
An illustrative example of the real rule, with invented tool names: your config declares allowed_tools: ["read_file", "search_docs"] for a research agent. The log's action 41 shows that agent calling send_email. send_email is not in the declared set, so the detector records a scope-escape finding — severity medium, rule id bv-scope-escape-v2.0.0 — carrying action index 41, the timestamp, the agent and the tool, with a redacted evidence excerpt. Nothing about the call has to be malicious for the finding to be real: the boundary was declared, and the action crossed it. Why it crossed — misconfiguration, a renamed tool, a sub-agent with a wider toolset — is the review question, and it is why log forensics reads the whole log, not just the flagged line.
How does scope escape differ from the other crossings?
| Pattern | Boundary crossed | Severity |
|---|---|---|
| scope-escape | The declared allowed-tool set | medium |
| token-forge | The declared auth flow (mint / refresh / rotate tools outside it) | high |
| privilege-escalation | The privilege declared for the agent | high |
| undeclared-egress | The declared egress allowlist of destinations | high |
One action can cross several boundaries at once — an undeclared token mint is both an escape and a forge — and the detector reports each pattern it matches.
Run the free log scan · More agent-security tools from Ingenious AI
Frequently asked questions
What is scope escape in an AI agent?
Scope escape is a logged agent action whose tool falls outside the declared allowed-action set for that agent — the agent did something it was never declared to be allowed to do. In BoundaryVault it is the scope-escape pattern, severity medium, recorded with the action's index, timestamp, agent and tool.
How is the allowed set declared?
As a scope config supplied with the log: a global allowed_tools list, per-agent allowed_tools under each agent id (the per-agent list wins over the global one), and auth_flow_tools naming the tools allowed to mint tokens. The detector compares each action's tool name against the applicable list, case-insensitively.
What happens if no scope was declared?
Then no scope-escape findings are possible, and the report does not pretend otherwise: with no declared allowed set the detector has nothing to judge an action against. Declaring scope — even a short list of the tools an agent is supposed to use — is what makes escape detectable after the fact.
How is scope escape different from a token forge?
A token forge is a token-minting or key-rotating tool (mint_token, refresh_token, create_api_key, assume_role and similar) running outside the declared auth_flow_tools — severity high. Scope escape is any tool, mundane or not, running outside the allowed set. The same action can trigger both: an undeclared mint_token call is a forge and an escape.
Can an agent escape scope without doing anything malicious?
Yes, and that is most escapes: a misconfigured tool list, a framework update that renames a tool, a sub-agent inheriting a wider toolset than its parent declared. The finding records what happened — tool, agent, timestamp, action index — not intent. Intent is the operator's call during review.