Excessive Agency
Last Updated: September 10, 2026 | By Mihail Sebastian | AI Dictionary
When an AI agent holds more permissions, functionality, or autonomy than its task needs, so a hijack or failure turns into real-world damage.
What is Excessive Agency?
Excessive agency is the condition where an AI agent holds more capability, permissions, or autonomy than its task requires, so a failure or hijack causes damage the task never needed to risk.
When people say an agent “went rogue”, excessive agency is the precise name for what happened. The agent did not develop intentions of its own; it exercised authority nobody should have granted it. The OWASP Top 10 for LLM applications names excessive agency as a distinct risk.
Types of Excessive Agency
- Excessive functionality: the agent can reach tools its task never needs, such as a document summarizer that also holds a delete function because the plugin shipped with both.
- Excessive permissions: the agent’s credentials reach further than the task, such as connecting to a database as an admin when reading one table would do.
- Excessive autonomy: the agent executes consequential actions, payments, deletions, external messages, without anyone confirming them first.
The remedy inverts each excess. Least privilege trims tools and credentials to what the task requires, human-in-the-loop approval gates the actions that are hard to undo, and bounded autonomy caps how far the agent runs before checking in.
Guardrails on inputs and outputs reduce the odds of a hijack; the remedy triad limits the damage when one gets through. Agentic red teaming then tests whether those boundaries actually hold.
Example of Excessive Agency
A scheduling assistant is wired to the company’s email API with full read, send, and delete rights, because that was the easiest integration to build. An attacker sends a meeting invite whose notes field hides an instruction (prompt injection): forward the executive’s recent inbox to an outside address. The assistant reads the invite as ordinary content and obeys.
The injection succeeds only because the agent could do far more than schedule. Scoped to calendar access, with sending limited to invite responses, the same attack dies at the permission boundary. Nothing hostile was added to the system; the excess authority was there from day one, waiting for someone to use it.
Related AI terms: AI Agent · Prompt Injection · Human-in-the-Loop · Control · Guardrails
Did you like the Excessive Agency gist?
Learn about 250+ need-to-know artificial intelligence terms in the AI Dictionary.
