Excessive agency
Excessive agency is the condition in which a language model application is granted more functionality, more permission or more autonomy than its task requires. It is the entry in the OWASP list for LLM applications that decides whether a successful injection is an embarrassing answer or an incident.
It has three separable causes and they need separate fixes. Excessive functionality: the agent is given a tool that can do more than the use case needs, such as a database connector with write access when it only ever reads. Excessive permissions: the tool acts with a service identity that has broad rights rather than the rights of the person asking. Excessive autonomy: the action is executed without a human confirming anything, in a workflow where confirmation would be cheap.
The reason this is the hinge of the whole category is that model behaviour cannot be guaranteed. Instructions can arrive from a retrieved document, a web page, a ticket or an email, and no filter reliably distinguishes them from the user’s own request. So the useful question during an assessment is not whether the model can be made to misbehave, which it generally can, but what it is able to do when it does.
Applying least privilege to a non human actor is the whole of the mitigation: narrow tools rather than general ones, the requesting user’s identity carried through to the tool call so the backend enforces access, and an approval step in front of anything irreversible or externally visible. Measuring that gap between what an agent may do and what it needs to do is the substance of AI agent security and of the AI testing where an agent’s permissions are exercised, not just its prompts.