Here's an example, just in case the question isn't clear.
20 employees, 20 million shares in option pool.
Each employee is given 2 million shares with standard terms (1 year cliff, 25% vesting on first anniversary, and monthly vesting after that).
Obviously, 20 employees times 2 million shares each is 40 million shares, which is more than the size of the option pool. The company is betting that not all of the employees' shares will be exercised.
Are they legally allowed to "overcommit" like this?
In my opionion that would be fraud. You make commitments which you are in the beginning not allowed / intending to honor.
No, you can not do this. It's not just fraud, it's SEC Fraud.
You could authorize 40 M shares and then return shares which end up not being used to the corporation but if you give them out, they have to be authorized and any future investors must be informed that they could have significantly more dilution than they might have expected.
I have no idea whether this is criminal fraud or what the SEC would think.
But if people want to exercise more options than you have available shares, all your choices will land you in hot water:
You're also setting yourself up for a form of blackmail. Eleven of your employees could get together and say, "We'd like to exercise our options right now. Although... if you'll give us a hefty chunk of cash, we could change our minds."
I would not go down this road.