Concept dictionary
Excessive Agency
Excessive agency is a vulnerability in which an AI system can perform damaging actions because it has more functionality, permissions, or autonomy than its intended task requires.
- Review state
- Reviewed in POC
- Freshness
- Current
- Version
- 1
Also called
- Excessive Agency
Remember it this wayDo not give the agent more reach than the job requires.
In plain language
An agent may be able to use tools, reach data, or take actions beyond what its job needs. If the model is mistaken, manipulated, or given an ambiguous request, that extra authority increases what can go wrong.
Why it matters
AI-generated decisions are not dependable security boundaries. Limiting tools, permissions, action scope, and autonomous execution reduces the damage a bad output or attack can cause.
Example
A mailbox assistant only needs to summarize messages, but its connection can also send and delete email. A prompt injection causes it to forward confidential messages and remove the originals without approval.
Common misconception
Excessive agency does not mean that any agent action or autonomy is unsafe. The vulnerability is the mismatch between the task and the functionality, permissions, or independent action the system has been given.
Related terms
Sources
- OWASP GenAI Security Project, “LLM06:2025 Excessive Agency”identifies excessive functionality, permissions, and autonomy as the principal causes and documents preventive controls.
Learn more
- Reduce action scope through [[guardrails|Guardrails]] and preserve meaningful intervention through [[human-oversight|Human Oversight]].
- Review the attack path in [[prompt-injection|Prompt Injection]].