# Bounded autonomy interview questions > 6 bounded autonomy interview questions for AI and ML engineer roles, each with a model answer. Canonical: https://llmdojo.dev/interview/topic/bounded-autonomy Last updated: 2026-10-23 6 questions: 1 junior, 3 mid-level and 2 senior. Taught in [Bounded Autonomy: Limits, Permissions and Sandboxes](https://llmdojo.dev/learn/agents-harness-engineering/bounded-autonomy). ## [What is excessive agency?](https://llmdojo.dev/interview/q/what-is-excessive-agency) Level: Junior An application that can take damaging actions when model output is unexpected, ambiguous or manipulated. OWASP names three causes: excessive **functionality**, **permissions** and **autonomy**. **Diagram: Three ways to give an agent too much** 1. OWASP's LLM06:2025, Excessive Agency, names three root causes. First: tools with more functionality than the application needs. 2. Second: tools that reach downstream systems with more permissions than their task requires. 3. Third: high-impact actions taken without independent verification or approval. 4. OWASP's point: excessive agency enables damaging actions in response to unexpected, ambiguous or manipulated outputs, whatever caused them. Limit the agency, and every cause does less harm. ## [What stopping conditions would you put on an agent?](https://llmdojo.dev/interview/q/what-stopping-conditions-would-you-put-on-an-agent) Level: Mid-level Limits on **steps**, **cost**, **wall-clock time**, **repeated identical calls** and **consecutive failures**, all checked by the harness. Anthropic recommends stopping conditions such as a maximum number of iterations. When one fires, checkpoint, report what was and wasn't done, and hand over. ## [How do you apply least privilege to an agent's tools?](https://llmdojo.dev/interview/q/how-do-you-apply-least-privilege-to-an-agent-s-tools) Level: Mid-level Only the tools it needs, each doing only what's needed; **narrow** tools over open-ended ones like a shell; **read-only** where possible; actions run **as the user**; authorisation enforced downstream on every request. A tool that can't express a harmful action can't be talked into it. ## [Where should “refunds over $100 need approval” be enforced?](https://llmdojo.dev/interview/q/where-should-refunds-over-100-need-approval-be-enforced) Level: Mid-level In the harness, in the refund tool's wrapper, checking the **argument** before the call runs. The prompt can describe the rule so the model explains the wait, but code decides what runs. A policy uses facts the model doesn't control, like the customer's address from the ticket system. ## [How do you defend an agent against instructions hidden in tool output?](https://llmdojo.dev/interview/q/how-do-you-defend-an-agent-against-instructions-hidden-in-tool-output) Level: Senior Treat every tool result as **untrusted input**. Detection is unreliable, so block **outcomes**: a recipient rule stops an injected email without anyone noticing the injection. **Diagram: Tool output is untrusted input** 1. Anything a tool reads (a ticket, a web page, a document, an email) can contain text written by someone else, including instructions. 2. Once read, that text sits in the context alongside your instructions. This is the indirect prompt injection of Module 03. 3. There's no reliable way to make the model ignore it, so assume it sometimes won't. 4. The defence that holds is in the harness: limits on what any action can do, checked in code. 5. The policy doesn't need to detect the attack. It only needs to forbid the outcome. Don't let tool output widen permissions, and be wary of chains that give a stranger's text a route to write tools. ## [What is the lethal trifecta, and how do you break it?](https://llmdojo.dev/interview/q/what-is-the-lethal-trifecta-and-how-do-you-break-it) Level: Senior **Private data**, **untrusted content**, and a way to **communicate externally**, in one agent. Then injected instructions can exfiltrate data. Willison's advice: avoid the combination; a filter catching 95% of attacks is a failing grade against an adversary who retries. Remove a leg, fix the recipients, or split the work across agents. ## Related - [All interview questions](https://llmdojo.dev/interview)