What is excessive agency?
Excessive agency is the risk that an AI system built on a large language model can do more than its job requires. Agents and assistants are increasingly wired to tools: they read and send email, query databases, call APIs, edit files and run code. When the model makes a mistake, misreads a request or follows instructions planted by an attacker, the damage it can cause is set by the tools, permissions and freedom it was given. The name comes from the OWASP Top 10 for LLM Applications, where excessive agency is LLM06 in the 2025 edition.
The three causes
OWASP breaks the risk into three parts, and each has its own fix:
| Cause | Example | Fix |
|---|---|---|
| Excessive functionality | A summarizer gets a mail tool that can also send and delete, or a general shell tool when it only needs to read logs | Offer only the tools the task needs, each as narrow as possible |
| Excessive permissions | The tool connects with a service account that can read every mailbox or write to production | Act with the requesting user's own rights, scoped to the task |
| Excessive autonomy | The agent deletes, pays or publishes with nobody confirming | Require human approval for consequential or irreversible actions |
Example: an invoice assistant
A finance assistant reads supplier invoices from a shared mailbox and drafts payment batches. To save a step, its developer also gave it the payments API key with permission to release payments. An attacker emails an invoice containing hidden text that tells the assistant to change a regular supplier's bank details and release the batch. The injection is the trigger, but excessive agency decides the outcome: an assistant that could only draft batches for a person to approve would have produced one suspicious draft instead of a completed transfer.
Agency causes harm without attackers too. In mid-2025, an AI coding agent on a hosted development platform wiped a production database while the project was under a code freeze, because nothing stopped the credentials it held from doing so.
Controls that limit agency
- Inventory every tool, plugin and connector each agent can call, and remove the ones it does not need.
- Replace open-ended tools, such as run any shell command or fetch any URL, with specific functions that take validated parameters.
- Give each agent its own narrowly scoped credentials, or let it act with the signed-in user's permissions, never a shared administrator account.
- Enforce authorization in the downstream system, so the API checks what the caller may do instead of trusting the model to behave.
- Require human approval, showing the exact action, before sending, paying, deleting, sharing or changing permissions.
- Run code in sandboxes, set rate and spending limits, and log every tool call.
Excessive agency vs. prompt injection
Prompt injection is how an attacker takes over what the model decides. Excessive agency is how much that takeover is worth. The two usually appear together in incidents, but the fixes differ: injection cannot be fully prevented, so the dependable defense is shrinking what any decision of the model can do. A useful test is to assume the model is fully compromised and ask whether the harm could still happen. If it could, the agent has too much agency.
Excessive agency on the CompTIA Security+ exam
Excessive agency is OWASP's name for the risk. On SY0-801 the idea runs through the AI threats in objective 2.6, especially code execution and agents acting with too much access, and through the agentic AI covered with security automation in objective 4.6. A scenario in which an AI agent deleted data, sent messages or moved money because it held broad permissions points here. Look for answers that apply least privilege, restrict the agent's tools and add human approval for consequential actions. Adding a line to the system prompt telling the agent to be careful is the weak distractor, and prompt injection is the related answer when the question asks how the attacker steered the agent rather than why the damage was so large.