Review Excessive Agency

Excessive agency is a vulnerability in which an AI system can perform damaging actions because it has more functionality, permissions, or autonomy than its intended task requires.

An agent may be able to use tools, reach data, or take actions beyond what its job needs. If the model is mistaken, manipulated, or given an ambiguous request, that extra authority increases what can go wrong.

AI-generated decisions are not dependable security boundaries. Limiting tools, permissions, action scope, and autonomous execution reduces the damage a bad output or attack can cause.

A mailbox assistant only needs to summarize messages, but its connection can also send and delete email. A prompt injection causes it to forward confidential messages and remove the originals without approval.

Excessive agency does not mean that any agent action or autonomy is unsafe. The vulnerability is the mismatch between the task and the functionality, permissions, or independent action the system has been given.

Do not give the agent more reach than the job requires.

* [[ai-agent|AI Agent]] * [[prompt-injection|Prompt Injection]] * [[guardrails|Guardrails]] * [[human-oversight|Human Oversight]] * [[objective-escape|Objective Escape]]

* [OWASP GenAI Security Project, “LLM06:2025 Excessive Agency”](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) — identifies excessive functionality, permissions, and autonomy as the principal causes and documents preventive controls.

* Reduce action scope through [[guardrails|Guardrails]] and preserve meaningful intervention through [[human-oversight|Human Oversight]]. * Review the attack path in [[prompt-injection|Prompt Injection]].