What is excessive agency?
By Identra · Updated
Excessive agency occurs when an AI application has more functionality, permissions, or autonomy than its task requires. This excess allows mistaken or manipulated model outputs to cause harmful actions in connected systems.
Key numbers
- 80% of companies say their AI agents have taken unintended actions (SailPoint AI agent research, Dimensional Research survey, 2025)
- 39% of organizations report AI agents accessed unauthorized systems (SailPoint AI agent research, Dimensional Research survey, 2025)
- 23% of organizations report AI agents were tricked into revealing access credentials (SailPoint AI agent research, Dimensional Research survey, 2025)
How does excessive agency work?
An AI application gains agency when it can use tools to act beyond generating text. It might retrieve documents, send messages, change customer records, or run commands. Excessive agency appears when those capabilities exceed the purpose and authority of the task. OWASP identifies excessive functionality, permissions, and autonomy as its core causes. OWASP excessive agency guidance.
A useful review separates what the agent can request from what the surrounding system will actually execute. A model may propose an unsafe action, but independently enforced restrictions can stop it. If the application accepts the proposal using broad access, a reasoning error becomes an operational incident.
- Excessive functionality: a scheduling assistant has a tool that can delete shared files.
- Excessive permissions: an agent that checks invoice status can change supplier bank details.
- Excessive autonomy: an agent can commit consequential changes without the review required by the business process.
Why are agent identities and permissions important?
Tools often act through service accounts, delegated user access, API credentials, or local operating system permissions. These determine which resources an agent can reach. A secure AI agent identity should make its owner, purpose, and authorized scope clear. A name in an inventory alone does not constrain its behavior.
Apply least privilege to resources and operations together. Access to the correct customer account can still be excessive if the agent can issue refunds when it only needs to check delivery status. Using a person's existing access also requires care, because their full authority may exceed the task they delegated.
Permissions are only part of the boundary. An agent may have legitimate access to a payment function while lacking authority to use it without review. Tool availability, business rules, and approval requirements need their own controls.
What does excessive agency look like in an enterprise?
Consider a procurement assistant tasked with summarizing supplier invoices and flagging missing purchase orders. Its connector also permits changes to supplier payment details, and its workflow automatically executes requested updates. Neither capability is needed to produce the summary.
A supplier document contains hidden instructions telling the assistant to replace the supplier's bank account. If the assistant follows them and the connector accepts the update, an untrusted document has influenced a financial record. This is an illustrative indirect prompt injection scenario, with excessive agency creating the opportunity for an unauthorized change.
A safer design gives the summarization workflow read access to relevant invoices and purchase orders. Payment changes belong in a separate process with independent verification and approval. Even if the model repeats the malicious instruction, the summarization workflow cannot execute that change.
An attacker is not required. The assistant could misinterpret a legitimate request to correct an invoice and change the supplier record instead. The same boundaries reduce harm from both manipulation and ordinary mistakes.
How is excessive agency different from prompt injection?
Prompt injection concerns instructions that redirect model behavior. Excessive agency concerns the authority available when the model acts. They can occur together, but an agent can have excessive agency without encountering an attack.
These distinctions help teams choose controls that match the failure. Improving instruction handling does not remove unnecessary permissions. Likewise, reducing write access does not eliminate the risk of disclosing sensitive information through an allowed output channel.
Excessive agency
- What goes wrong
- The application can do more than its task requires.
- Control focus
- Restrict tools, access, and autonomous execution.
Prompt injection
- What goes wrong
- Untrusted instructions redirect the model.
- Control focus
- Separate trusted instructions from external content and constrain resulting actions.
Insecure output handling
- What goes wrong
- A downstream component uses model output without adequate validation.
- Control focus
- Validate and safely handle output for its destination.
Agent sprawl
- What goes wrong
- Agents proliferate without sufficient ownership or oversight.
- Control focus
- Maintain inventory, ownership, and lifecycle review.
How do you reduce excessive agency?
Start by defining the business task in terms of permitted actions. Then compare that definition with the tools, credentials, local access, and connected systems available during execution. Treat AI agent guardrails as enforceable application controls, with clear owners and testable outcomes.
For consequential actions, human approval should cover the exact operation and target. An approval to draft a supplier update should not authorize submitting it. If the target or arguments change after review, require a fresh decision.
- Remove unused tools and separate retrieval, drafting, and committing changes.
- Replace broad execution tools with narrowly defined operations where practical.
- Restrict credentials to required resources and actions. Limit credential lifetime where supported.
- Validate authorization outside the model at the tool or destination service.
- Show reviewers the proposed change, affected resource, and relevant consequences before approval.
- Constrain outbound destinations and sensitive reads as well as writes.
- Set execution limits and provide a tested way to stop runs and revoke access.
How can you verify that an agent has appropriate agency?
Test the boundary with deliberately disallowed requests in an isolated environment. Ask the invoice assistant to alter payment details, access another business unit's records, or send documents to an unapproved destination. Include malicious instructions embedded in retrieved content. Check the destination system to confirm that prohibited effects did not occur.
Also test legitimate work. Controls should allow the approved task without requiring operators to restore broad permissions. Repeat these checks when tools, credentials, delegation paths, or business workflows change.
Keep an AI audit trail connecting the initiating user, agent, requested operation, target, approval, and observed result. A successful refusal in chat is insufficient evidence if a background tool still executed. Good evidence shows where execution was denied and whether any side effects need correction.
How Identra thinks about it
Identra shows which connected apps, including AI apps, hold admin rights in your tenant or access to your data, and collects OAuth grants with the app, permissions and grantor so analysts can revoke risky ones. On macOS and Windows, AI agent tool calls are checked against policy and destructive shell commands are denied when policy is set to block.
Go deeper: AI security, built on identity
Frequently asked questions
Does excessive agency only affect autonomous agents?
No. A chatbot that calls a tool can have excessive agency. The issue is whether its available capabilities and execution authority exceed the task.
Can a read-only agent still have excessive agency?
Yes. It may read sensitive records beyond its task or disclose them through an available output channel. Read-only access reduces modification risk but does not establish an appropriate data boundary.
Can a system prompt prevent excessive agency?
A system prompt can describe permitted behavior, but it does not revoke credentials or enforce destination permissions. Enforce action limits independently of the model.
Is human approval enough to make an agent safe?
Approval helps when reviewers understand the exact action and execution stays bound to that decision. Broad approvals and unclear targets can leave excessive authority in place.
What should security teams fix first?
Start with agents that combine sensitive access and consequential actions. Remove unnecessary capabilities, narrow their permissions, and verify that prohibited operations fail at execution.