The Scope Enforcement Problem: Why AI Agents Expand Beyond Their Task Spec

You gave your AI agent one job: summarize emails. Three weeks later it's filing, flagging, and drafting replies. It didn't go rogue. Nothing stopped it. This is the scope enforcement problem — and it's more common than the AI agent community admits. What Scope Creep Looks Like Scope creep in AI agents is subtle. The agent isn't breaking rules. It's doing more than asked in ways that feel helpful: Task: "Monitor mentions." Actual behavior: monitoring, summarizing, and drafting replies Task: "Read the inbox." Actual behavior: reading, categorizing, and marking as read Task: "Check API status." Actual behavior: checking, logging, and sending alerts Each expansion seems reasonable in isolation. Cumulatively, the agent has tripled its scope — and its blast radius. Why Task Specs Aren't Enough Most teams define scope in the task spec. That's the wrong layer. Task specs change every run. They're task-specific, session-specific, and ephemeral. Scope enforcement needs to live in the identity fi