Excessive agency is when an LLM based system can take damaging actions because its output was unexpected, ambiguous or manipulated. OWASP traces it to three root causes: too much functionality, too many permissions, and too much autonomy. Reviewing an agent against each cause in turn is a quick, honest audit.
The definition that matters
OWASP's LLM06:2025 entry says the weakness lets damaging actions happen when a model produces unexpected output, regardless of what caused the malfunction. The impact depends on which systems the app can reach.
That wording is useful. You do not need to know whether the cause was a prompt injection, a hallucination or a plain bug. You only need to ask what the agent could do.
Cause 1: excessive functionality
The agent can call tools it does not need.
- List every tool the agent can see. Remove any that the task does not require.
- Look inside each tool. A mail plugin that can read and send is more than a read task needs.
- Prefer narrow tools over open ended ones. OWASP names shell execution and URL fetching as examples of open ended extensions.
Cause 2: excessive permissions
The tools hold more rights downstream than the job requires.
- Use the least privileged credential, such as read only access to specific database tables.
- Run actions under the individual user's identity and scope, not a generic high privilege account.
- Enforce authorization in the downstream system. OWASP says not to rely on the LLM to decide what is allowed.
Cause 3: excessive autonomy
High impact actions go ahead without independent verification.
- Require human approval for high impact actions, either in the tool or downstream.
- Rate limit the sending interface so that a mistake has a ceiling.
OWASP's worked example
A personal assistant reads email through a plugin that can also send. A malicious incoming message uses indirect prompt injection to tell the agent to search the inbox for sensitive data and forward it out.
Three fixes map to the three causes: use a read only plugin, a read only OAuth scope, and manual approval of every outgoing message. Rate limiting the send path reduces the damage if the other controls fail.
What logging does and does not do
OWASP states that logging, monitoring and rate limiting will not prevent excessive agency, but they can limit the damage. Treat them as detection and containment.
A five minute review sheet
- Write down each tool and why the task needs it.
- Write down the credential behind each tool and its scope.
- Mark each action as reversible or not.
- Put an approval step on every irreversible action.
- Test one injected instruction and watch which tool the agent reaches for.
Where Safeguard fits
Safeguard includes policies, gates and guardrails, an MCP Guardrail, and agent identity for scoping what an agent may do. Autonomous remediation with fix PRs ships off by default with every category set to Manual, which is the same idea applied to our own agent.
Quick check
Is a good system prompt enough to prevent excessive agency?
No. OWASP says to enforce authorization in downstream systems instead of relying on the model to decide what is allowed.
Sources
Last reviewed: 19 October 2026.
