In one sentence
The risk that an AI system can take damaging actions because it has more functions, permissions or autonomy than its task needs.
Excessive agency is the risk that an AI system does harm through actions it was able to take but should not have been able to take. OWASP lists it as LLM06 in its Top 10 for LLM Applications 2025 and names three root causes: excessive functionality, excessive permissions and excessive autonomy.
Excessive functionality
means the agent has tools it does not need. A summarizing agent that can also send email has a tool it never needs for summaries.
Excessive permissions
means the tools it needs have broader access than the task requires, such as a read task running on an account that can write or delete, or a single admin key shared across systems.
Excessive autonomy
means high-impact actions run without a person checking them, such as payments, refunds, deletions or messages to customers.
Why it matters more than model errors
Models make mistakes, and prompt injection can steer them. Excessive agency decides how much those mistakes cost. A model that misreads an email and drafts a wrong reply costs a minute of review. The same model with permission to send, refund and delete can cost much more.
Controls OWASP recommends
include limiting tools to the minimum, avoiding open-ended tools such as raw shell or URL fetch where a narrow one will do, running tools with the user's own scoped permissions, requiring human approval for high-impact actions, and enforcing authorization in downstream systems rather than trusting the model to decide.
In our builds
every agent starts with a written list of allowed tools and actions. Read access is the default. Writes are scoped to specific records or fields, and actions that move money or send outside messages go through an approval step until results justify more autonomy. Our AI agent governance checklist covers these points in order.
Keep following the system
Prompt Injection
An attack where text in an input tricks an AI model into ignoring its instructions or taking actions it should not.
AI Agent Governance
The rules, roles, limits and records that decide what an AI agent may do, who answers for it and how it is checked.
Human in the Loop
A design where a person reviews, approves or corrects an automated or AI step before its result takes effect.
Computer Use Agent
An AI agent that operates software through a screen, mouse and keyboard, the way a person would, instead of through an API.
Tool Calling (Function Calling)
A model feature where the AI returns a structured request to run a defined function, which your code runs and returns.
Webhook
An HTTP message one system sends to another the moment an event happens, so the receiver does not have to keep asking.