Excessive Agency

An agent that only needs to read a calendar but holds permission to send email, delete files, and call payment APIs is a risk waiting for a trigger. Prompt injection, hallucination, or goal drift can turn that unused capability into harm.

Excessive agency usually comes from:

• Excessive functionality: Tools or plugins connected to an agent that its task never uses.
• Excessive permissions: Broad credentials, such as admin tokens, where read-only access would do.
• Excessive autonomy: High-impact actions that run without review or confirmation.
• Open-ended tools: Generic shell, browser, or HTTP tools that can do almost anything.
• Inherited privileges: Agents acting with a user's full rights rather than task-scoped rights.

Excessive agency multiplies the impact of every other agent vulnerability. A prompt injection against a narrowly scoped agent might leak a summary; the same injection against an over-privileged agent can move money or exfiltrate a database.

Reducing agency is one of the highest-return controls available, because it limits the blast radius of failures that cannot be fully prevented.

How PointGuard AI Helps

PointGuard AI Agent Identity & Access Security gives agents scoped, short-lived permissions tied to their task, and AI Security Posture Management flags agents with unused tools or over-broad credentials. Agent Mission Control then enforces mission boundaries at runtime, so even a manipulated agent cannot act beyond its intended role.

Learn More

• OWASP LLM06:2025 Excessive Agency
• OWASP Top 10 for Agentic Applications
• MITRE ATLAS