Excessive agency

What it means

Excessive agency is what happens when an AI system can do more than its task requires. OWASP names three causes: too much functionality, such as a tool that can delete when the job is only to read; too many permissions on the account behind it; and too much autonomy, with no person to approve risky actions.

It is least privilege applied to AI. The model is not trusted to decide safely, so its reach should be small enough that a wrong decision does little harm. Ask what the worst thing the agent could do is, then remove the tools and permissions that make that possible.

Why it matters

Models make mistakes and can be steered by text they read. When an agent can only draft a reply, a mistake is an awkward email. When it can send the email, issue a refund, change a record and call an API using a broad service account, the same mistake becomes an incident.

Combined with indirect prompt injection, it lets an outsider borrow your agent's access. The attacker never needs your login. They only need the agent to read something they wrote. The same applies to mistakes made without any attacker involved, such as a wrongly phrased request.

How it shows up

You meet it in assistants wired to email, calendars, ticketing, databases and code repositories. Typical mistakes: a plugin that exposes a whole API when one call is needed, one shared admin token for every action, a database user with write access for a read-only task, and no confirmation step before something irreversible.

Scope each tool narrowly. Run the agent as the signed-in person, so it can reach only what that person can. Use read-only access where reading is enough. Require human approval for money, deletion and outside messages. Log every tool call. Enforce all permissions in your own code and not in the prompt.