Excessive Agency

OWASP’s Top 10 for LLM applications lists excessive agency as LLM06:2025 and defines it as the vulnerability that lets an LLM-based system take damaging actions in response to unexpected, ambiguous, or manipulated model output, whatever caused the model to misbehave (OWASP, LLM06:2025 Excessive Agency). The trigger can be a hallucination, a prompt injection from a user or a document, or a compromised tool or peer agent. The point of the framing is that you cannot guarantee the model will behave, so you limit what its behavior can do.

OWASP traces the root cause to three kinds of excess. Excessive functionality means the agent can call tools it does not need: a document reader whose plugin can also modify and delete documents, or a plugin left over from development. Excessive permissions means a tool connects with more rights than the task requires: a read-only feature that connects to a database with UPDATE, INSERT and DELETE rights, or a per-user feature that uses one privileged account for everyone. Excessive autonomy means high-impact actions run without independent verification, such as deleting a user’s documents without confirmation.

The mitigations follow from that list. Together they apply the principle of least privilege, which NIST defines as restricting the access privileges of users, or processes acting on their behalf, to the minimum necessary to accomplish assigned tasks (NIST CSRC, least privilege). Give the agent the fewest tools you can, and the narrowest version of each: a specific file-writing tool instead of a shell. Run each action with the user’s own identity and the minimum scope, for example through OAuth. Require human approval for high-impact actions. And enforce authorization in the downstream system rather than asking the model whether an action is allowed, which OWASP calls complete mediation. A policy engine that sits outside the model is one way to do that.

This is why so much of agent security comes down to identity and permissions. AI agent identity and permissions and how to deploy AI agents safely cover the practical setup, and the AI security topic collects the episodes on it.