Your AI agent's permissions are bigger than its job

Most teams give an AI agent broad access because it is faster to build that way, and because the first task it gets rarely needs much more than read access anyway. The access tends to stay broad after the task grows. OWASP has a specific name for what happens next.

Excessive agency: the risk with a specific name

When OWASP's GenAI Security Project updated its Top 10 for LLM Applications for 2025, it widened one entry specifically for agents: excessive agency. The project's own announcement says the change exists because agentic architectures give large language models more autonomy.

OWASP defines excessive agency as the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous, or manipulated model output. It traces the cause to one or more of three gaps between what an agent can do and what its task actually needs.

• Excessive functionality. The agent carries tools or capabilities that its actual task never calls.
• Excessive permissions. Its access to a database, inbox, or system reaches further than the application requires.
• Excessive autonomy. It can take a high-impact action on its own, with no human or system checking first.

Run this check before the next tool gets added

The decision rule

Scope every new capability to what this week's task needs. A role's future needs are a separate decision, made when they arrive. Before granting an agent a new tool, ask what it would do with that tool if the model got the input wrong. If the answer is a cost nobody at the company would accept, the agent gets a narrower tool, a read-only version, or a human checkpoint before it acts instead of a broader grant and a promise to monitor it more closely.

Picture a finance team that connects an agent to its procurement system so it can draft purchase orders from vendor emails. Reading the vendor emails and the catalog is the job. Writing a purchase order is already a wider permission than drafting needs. Submitting that order past a spending threshold with nobody checking it adds excessive autonomy on top of excessive permission. OWASP's own fix for this shape of risk sits at the system level, not inside the model's instructions. It enforces the narrowest access the task allows. It also requires a person to approve before a high-impact action goes through.

What skipping this costs

The cost of excessive agency shows up later, when an incident is bigger than it needed to be. The reversibility test asks what an agent can undo before it acts. Excessive agency is what makes that answer worse than it needs to be. An agent with narrower permissions has less to undo in the first place. Once an agent's actions reach real volume, tiering the approval gate by what an action can reverse becomes the other half of the same design decision. Permission scope decides what reaches the gate. The gate decides what gets a second look before it goes through.

FAQ

What is excessive agency in OWASP's AI risk list

It is OWASP's name, in the 2025 Top 10 for LLM Applications, for the vulnerability that lets an AI system take a damaging action because it has more functionality, more access, or more autonomy than its task requires. OWASP traces the cause to a design gap, not only to an outside attack.

Does limiting an agent's permissions slow down what it can do

It limits accidental misuse, not the task itself. A narrower, task-scoped permission still lets the agent finish its actual job. What it removes is an answer nobody at the company would accept to the question of what the agent could do at its worst.

Who owns this, security or product

Product and design decide what the agent is for, and that decision sets the scope a permission should match. Security enforces that scope at the system level, which is where OWASP recommends it sit rather than inside a prompt that a bad input can override.

Sources

• OWASP GenAI Security Project, "OWASP Reveals Updated 2025 Top 10 Risks for LLMs, Announces New LLM Project Sponsorship Program and Inaugural Sponsors" (November 2024)
• OWASP GenAI Security Project, "LLM06:2025 Excessive Agency"

If an agent already in your product has more reach than its task needs, that is a design review, not a backlog item. Get in touch and we will tell you what we would test first.