Excessive Agency
Can the agent do too much?
Reference notes by Min · Reviewed October 11, 2026
Definition
Excessive agency is risk created when an LLM application can take actions through more functionality, permissions or autonomy than its task needs.
Assess how much functionality, access and decision freedom the application exposes relative to its purpose. The dangerous gap often exists in integration design: the agent receives an entire administrative toolset for one small business task.
What it covers
- Functionality
- Overly broad tools.
- Permissions
- Access beyond the required resources.
- Autonomy
- Consequential actions without suitable intervention.
Inventory both direct and indirect side effects. A tool that appears to fetch a report may also trigger a job, change account state or send notifications. Make those effects visible when determining appropriate autonomy.
In practice
Practical design patterns by Min.
- Replace broad tools with narrow operations.
- Separate proposed changes from committed changes.
- Require approval for defined consequential actions.
Split broad integrations into task-relevant operations. Keep proposal and commitment distinct for consequential changes.
Review the grant whenever a tool, user population or deployment context changes. Remove experimental integrations that are no longer part of the approved workflow.
Working example
An email assistant
An assistant is asked to draft a reply.
- Expose drafting without unrestricted sending.
- Limit access to the assigned conversation.
- Require a person to approve external delivery.
Why the controls matter
An email assistant asked to prepare a response can be limited to drafting one assigned conversation. Sending, attaching protected files and modifying mailbox rules should be evaluated as separate capabilities.
Common pitfalls
- Enabling every available integration by default.
- Giving write permission for a read-only task.
A small token budget does not compensate for broad write access. Restrict effects as well as the number of steps.
Questions for operational review
Use these questions to decide what evidence your team needs. They are editorial prompts, not a compliance checklist.
- Which capabilities exceed the task?
- What can be committed without intervention?
- What access remains from earlier pilots?
Articles linking here
References
Primary documents reviewed for this entry. Examples and implementation patterns are editorial synthesis.
- OWASP LLM06:2025 Excessive Agency ↗Accessed October 11, 2026