Excessive Agency

Excessive agency (OWASP LLM06 / a foundational agentic-AI risk) is a design defect, not a runtime event: it exists the moment an agent is provisioned with broader access than its defined task requires, whether or not that access is ever misused. A document-summarisation agent with write access to the document store, email-sending capability, and administrative API credentials is excessively privileged even if it only ever summarises documents in practice.

The blast radius of a compromised or manipulated agent is determined by its permissions, not its intended behaviour. This is the core reason excessive agency matters as a distinct risk category from prompt injection: injection is the attack vector, excessive agency is what determines how much damage a successful injection can do once it lands.

Excessive agency accumulates through three common paths: broad initial provisioning ('give it access to everything it might need'), scope creep over the agent's lifecycle as new tools are added without a corresponding permission review, and tool-level rather than action-level permissions (a tool grants write access to an entire resource when the task only ever needs to write one field).

The control is least privilege, applied at the tool level and re-verified on a cadence, not applied once at launch. Each agent should receive only the tool calls it needs, with the narrowest scope those tools can be granted. Where a tool's native permission model can't scope narrowly enough, the control has to move to a layer that can — a gateway or wrapper enforcing the narrower scope the underlying tool doesn't support.

Excessive agency is directly measurable in a security review: enumerate every tool and permission the agent holds, and for each one ask whether the agent's defined task actually requires it. Anything the task doesn't require is excess, regardless of whether it has ever been exploited.