Excessive agency is a weakness that lets an LLM based system take damaging actions in response to unexpected, ambiguous or manipulated model output. OWASP traces it to three causes: too much functionality, too many permissions and too much autonomy. In MCP, it appears as broad tools, broad tokens and no approval step.
The definition
OWASP lists Excessive Agency in its 2025 Top 10 for LLM applications. The key point in the definition is that the cause of the bad output does not matter. A confusing prompt, a hallucination or an injected instruction can all lead to the same damaging action if the system was allowed to take it.
Three causes, three MCP examples
| Cause | What it means | MCP example |
|---|---|---|
| Excessive functionality | Access to functions the task does not need | A server exposes delete and admin tools to an agent that only reads |
| Excessive permissions | Downstream access beyond the task | One token covers every scope the server supports |
| Excessive autonomy | High impact actions with no check | An agent merges or deploys without a person approving |
Fixing one does not fix the others. A narrow tool with a broad token is still risky, and a narrow token behind an unreviewed autonomous loop can still do a lot of harm.
The OWASP prevention list, translated
OWASP lists eight measures. In MCP terms:
- Minimize extensions: connect only the servers the job needs.
- Minimize extension functionality: disable tools you do not use.
- Avoid open ended extensions: prefer a narrow tool over shell access or a general URL fetcher.
- Minimize extension permissions: use read only database credentials where reads are enough.
- Execute in the user's context: act with the user's own scoped identity, not a shared account.
- Require user approval for high impact actions.
- Complete mediation: enforce authorization in the downstream system, not in the model's judgment.
- Sanitise inputs and outputs, and test with SAST and DAST.
OWASP adds that logging and monitoring extension activity, and rate limiting, limit the damage but do not remove the cause.
A short audit you can run today
- For each agent, list every tool it can call.
- Mark the tools it has used in the last month.
- Remove or disable the rest.
- Check the credential behind each server and cut it to the needed scope.
- Pick the three most destructive actions and require approval.
The MCP spec points the same way. It asks for access controls and rate limiting on servers, and for confirmation prompts on sensitive operations in clients.
Safeguard includes policies, gates and guardrails, and agent identity that records which agent holds which access. A free scan is at https://gold.safeguard.sh/scan.
Try it yourself
Watch which tools the assistant calls to answer a question and ask whether every one of those tools was needed for the task.
Click through it at your own pace, or open it full screen.
Quick check
Is excessive agency the same as prompt injection?
No. Prompt injection is one way to trigger a bad action. Excessive agency is the weakness that lets the action cause harm, and it applies whatever the trigger was.
Which cause should I fix first?
Start with permissions and functionality, since they are quick to cut and reduce harm from every trigger. Then add approval for the actions that cannot be undone.
Sources
Last reviewed: 19 October 2026.
