Glossary · 6 · Quality, risk and governance
Excessive agency
Also known as: LLM06, Excessive agency (LLM)
German: Übermäßige Handlungsbefugnis
Excessive agency is the vulnerability that lets an LLM-based application or AI agent perform damaging actions in response to unexpected, ambiguous or manipulated model output, because it was given more functionality, more permissions or more autonomy than its task needs.
- Intermediate
- Technical project managers
- Developers
- Technical writers
In one sentence
Excessive agency: an AI agent can do more damage than its task requires — too many tools, too many rights, too little approval. OWASP LLM06:2025.
Example
A summarizing agent only needs to read tickets, but its connector uses an account that can also close and delete them; a manipulated ticket text makes it close fifty open safety reports.
Explained in context
This term is a station of a mini course
- When an AI agent crosses the line: detect, contain and restore operationsStation: The boundary in three partsStart the course
Context cards connect this term with others to answer one question. Also in British English and German.
- Permission, capability, mandate: the three parts of an AI agent’s boundaryWhich boundary does an AI agent cross when it “goes too far” — and why does it matter which one?UKDeutsch
- When an AI agent crosses the line: detect, contain and restore operationsWhat has to be in place when an AI agent does something it isn’t allowed to do — in IT systems, IoT fleets, OT and on machines — and how is it detected, stopped and released again?UKDeutsch
- Indirect prompt injection in agent chainsHow does indirect prompt injection travel through a chain of AI agents, and what changes when the chain gets control points?UKDeutsch
How it applies
- Three root causes: OWASP names excessive functionality (the agent can reach tools it doesn't need), excessive permissions (a tool connects with an identity that can do more than the task) and excessive autonomy (high-impact actions run without independent verification or approval).
- The trigger doesn't matter: A hallucination, a misunderstood instruction or a prompt injection all lead to the same damage once the agent is allowed to act. Excessive agency is about what the agent can do, not about why it went wrong.
- The fix is design, not a better prompt: Narrow the agent permission scope, keep a tool allowlist, route irreversible actions through an action approval gate, and apply the principle of least privilege to the accounts behind every tool.
- In plants and products: An agent connected to a SCADA system, a manufacturing execution system or a device fleet has excessive agency as soon as it can write where it only needed to read.
Why it matters on your learning path
- Technical writers: Document what an agent may do, not only what it does. A capability list without limits invites excessive agency.
- Technical marketers: “It can do everything for you” is the description of the vulnerability. Describe the limits as a feature.
- Technical project managers: Ask for the tool list, the accounts behind it and the approval points before an agent goes live.
- Developers: Remove unused tools, give each tool its own minimal identity and require confirmation for writes and deletes.