Check three things for each agent: does it have more functionality than the task needs, more permission than each function needs, and more autonomy than the impact of its actions allows? OWASP names these as the typical root causes of excessive agency, and each has its own fix.
The three causes
OWASP's guidance lists excessive functionality, excessive permissions and excessive autonomy. They are different problems. An agent can have a tiny tool list with admin credentials (permissions), or tight credentials with a tool for everything (functionality), or both well scoped but no human check on a destructive call (autonomy).
Checklist
| Cause | Question to ask | A good answer |
|---|---|---|
| Functionality | Which tools does the agent hold that its task never calls? | None, or each has a written reason |
| Functionality | Are any tools open ended, such as shell or fetch any URL? | No, or sandboxed |
| Permissions | What account does each tool use downstream? | A narrow account for that agent |
| Permissions | Does the tool act as the user or as a shared account? | As the user where possible |
| Autonomy | Which actions run with no human check? | Only undoable, low impact ones |
| Autonomy | Is there a cap on calls, spend or volume? | Yes, with an alert |
Steps to run the check
- Pick one agent and gather its tool list, credentials and approval settings.
- Walk the table with the owner and write the actual answer, not the intended one.
- For every weak answer, assign a fix: remove a tool, narrow a credential, add an approval.
- Fix functionality first, because removing a tool removes its permission and autonomy issues too.
- Re-run the check after changes and keep the before and after as evidence.
Reading the results
Teams usually find the largest gap in permissions, because a convenient shared credential sits behind many tools. OWASP recommends executing extensions in the user's context with minimal privileges, for example OAuth with the narrowest scope. Where that is not possible, give the agent its own narrow account.
Do it per agent
Aggregate scores hide the dangerous one. Run the check on each agent, starting with the ones that read untrusted content or touch customer data.
Safeguard offers MCP Guardrail and agent identity for applying this kind of policy to agent tool calls, and you can run a free scan of your own repositories at gold.safeguard.sh/scan. Autonomous fix pull requests are off by default, and every category starts on Manual.
Quick check
Which cause should I fix first?
Functionality. Removing an unneeded tool removes the permissions and autonomy risk attached to it.
How often should I rerun the check?
At each access review and whenever the tool list or prompt changes materially.
Sources
Last reviewed: 19 October 2026.
