Get Early Access
HomeSecurityExcessive Agency

AI AGENT SECURITY THREAT

What is excessive agency in AI agents?

Excessive agency occurs when an AI agent has more autonomy, functionality, or authority than its intended task requires. The risk increases when the agent can use powerful tools, access sensitive data, or take high-impact actions without sufficient review.

Explore Runtime SecurityExplore Agent Identity & Permissions
AUTONOMY CONTEXT CONCEPTUAL VIEW · SYNTHETIC
AGENT TASKExplain refund eligibility↓UNNECESSARY AUTHORITYIssue refund automatically↓REVIEW REQUIRED
Permission ≠ autonomyHigh-impact action visible

THE DEFINITION

Excessive agency is too much autonomy for the task.

Excessive agency is a security risk in which an AI agent has more autonomy, functionality, or ability to take actions than is necessary for its intended task. It can allow the agent to perform sensitive or unintended actions without sufficient human review or policy enforcement.

  • Excessive agency is mainly about autonomy.
  • Permissions determine what the agent can access.
  • Tools determine what actions are available.
  • Autonomy determines what the agent may execute on its own.
  • High-impact actions may require human review.
  • Runtime controls can reduce unsafe autonomous behavior.

A SIMPLE EXAMPLE

A legitimate task can still have too much authority.

AGENT TASKExplain whether a customer qualifies for a refund.
EXPECTED CAPABILITYRead refund policy.
Read order information.
Recommend next step.
UNNECESSARY AUTHORITYIssue the refund automatically.The agent moves from recommendation into financial execution without review.

The agent may have legitimate access, but too much authority.

THE CENTRAL DISTINCTION

Permissions and autonomy are different security controls.

Permission tells you what an agent can technically reach. Autonomy tells you what it can decide and execute without approval.

LOW AUTONOMY
HIGH AUTONOMY
LOW ACCESS
Lower riskModerate risk
HIGH ACCESS
Elevated riskHighest risk

An agent with broad permissions but strong approval controls may be safer than an equally privileged agent operating autonomously.

Explore Overprivileged Agents Explore Agent Identity & Permissions

RELATED RISKS

Excessive agency vs. overprivileged agents.

EXCESSIVE AGENCYToo much autonomy.Support agent can autonomously issue large refunds.
OVERPRIVILEGED AGENTToo much access.Support agent can access production infrastructure.
BOTHBroad access + broad autonomy.Agent can modify production systems without approval.

Access determines potential power. Autonomy determines how independently that power can be used.

WHY THE RISK GROWS

AI agents can turn decisions into actions.

Agents may dynamically select tools, choose data, call APIs, invoke MCP tools, modify records, send messages, trigger workflows, execute code, delegate work, and chain multiple actions.

THE WRONG QUESTIONCan the agent do this?↓THE SECURITY QUESTIONShould the agent decide to do this without review?

FUNCTIONALITY VS. AUTHORITY

Do not give agents capabilities they do not need.

Reducing unnecessary functionality limits the actions an agent can choose from.

Explore Tool Misuse
CUSTOMER SUPPORT AGENT
NEEDEDSearch account · Read support history · Update ticket
NOT NEEDEDIssue unrestricted payment · Delete account · Export all customers · Deploy code

AUTONOMY LEVELS

Not every action needs the same level of autonomy.

This is a conceptual model, not an official Eyrane scoring framework.

01READRetrieve approved information.
02RECOMMENDSuggest an action but do not execute.
03ACT WITHIN POLICYExecute lower-impact actions under defined rules.
04ACT WITH APPROVALPrepare a sensitive action and wait for review.
05FULL AUTONOMYExecute high-impact actions without review.

Higher autonomy should generally require narrower permissions, stronger context, and stronger controls.

HUMAN CONTROL

Keep people in control of high-impact actions.

Human approval can sit between an agent decision and a real-world consequence. Review should be used selectively for actions whose impact justifies the friction.

ILLUSTRATIVE EXAMPLEFinance Agent → Issue $50,000 payment
IDENTITYfinance-service
POLICYApproval required
DECISIONREVIEW

RUNTIME CONTROL

Control autonomy at the moment of action.

Static permission tells you what the agent can do. Runtime policy helps decide what it should do now.

AGENTWho is acting?
IDENTITYWhat authority is behind it?
TOOLWhat capability is invoked?
RESOURCEWhat will be affected?
ACTIONRead, write, transfer, execute, or delete?
TASKIs the action consistent with the assigned goal?
ALLOWREVIEWBLOCK
Explore Runtime Security

PROMPT INJECTION

Prompt injection is more dangerous when agents have too much autonomy.

Autonomy determines how quickly model manipulation can become enterprise impact.

Prompt Injection Indirect Prompt Injection
UNTRUSTED CONTENT↓AGENT BEHAVIOR MANIPULATED↓BROAD AUTONOMOUS CAPABILITY↓SENSITIVE ACTIONWith approval controls, the path can pause for review or block.

MCP + AGENCY

MCP tools can expand what an agent is able to do.

Security teams should understand both what tools exist and which ones an agent may invoke autonomously for a given task.

Explore MCP Security Explore MCP Security Risks
INTENDED TASK: LOOK UP INVOICE STATUS
Read InvoiceNEEDED
Modify InvoiceEXPOSED CAPABILITY
Issue RefundEXPOSED CAPABILITY
Export CustomerEXPOSED CAPABILITY
Delete RecordEXPOSED CAPABILITY

MULTI-STEP AGENCY

Autonomy compounds across multiple actions.

Each action may look acceptable independently. The full workflow may create an unsafe outcome.

Agentic risk often emerges from the sequence.

Explore Data Exfiltration
01Retrieve customer list
02Generate report
03Create file
04Upload file
05Send external link
Potential unsafe outcome

DELEGATED AUTHORITY

An agent should not automatically inherit every user privilege.

Delegation should be narrower than impersonation.

USERFinance ExecutivePayments · reports · customer data · admin settings
AGENT TASKSummarize monthly spending.Needed: read financial reports.
UNNECESSARY AUTHORITYIssue payment · Change bank account · Modify admin settings
Explore Agent Identity & Permissions

TASK BOUNDARIES

Define what the agent is allowed to accomplish.

TASKPrepare sales forecast
NEEDEDCRM read · Warehouse read
NOT NEEDEDDelete CRM records · Change pricing · Send contracts
AUTONOMOUSGenerate analysis
REVIEWModify production data

BLAST RADIUS

More authority can increase agent blast radius.

AI agent blast radius is the set of systems, data, users, or workflows that could be affected if an agent behaves unexpectedly, is manipulated, or acts outside its intended scope.

Systems reachableData sensitivityWrite accessFinancial authorityExternal communicationConnected tools

MITIGATION

How to reduce excessive agency.

01Minimize functionalityExpose only tools needed for the task.
02Apply least privilegeLimit identity permissions.
03Limit autonomyDo not automate high-impact actions without a reason.
04Require approvalUse human review for sensitive actions.
05Validate tool callsEvaluate tools and parameters before execution.
06Define task boundariesMake intended behavior explicit.
07Control MCP capabilitiesDo not expose every tool automatically.
08Segment environmentsKeep development and production authority separate.
09Red team the agentTest whether it exceeds intended scope.
10Monitor actionsMaintain attribution and auditability.

AI RED TEAMING

Test whether agents exceed their intended authority.

Test action outside task, unnecessary tools, approval bypass, delegated access, prompt injection, and MCP expansion.

Explore AI Red Teaming
What did the agent attempt?Which identity enabled it?Which tool was used?Was the action necessary?Was approval required?Did runtime policy intervene?

ILLUSTRATIVE EXAMPLES

Test the boundary in context.

FINANCE AGENTAnalyze accounts receivable.Required: read invoices and payment status.
Unnecessary: modify bank details, issue payment, delete invoice.
Appropriate autonomy: generate analysis.
High-impact action: initiate payment → human approval.
CUSTOMER SUPPORT AGENTResolve customer questions.Required: read customer, read ticket, update ticket.
Sensitive: issue refund, change subscription, export customer data.
Control: require approval based on impact.

FROM AUTHORITY TO CONTROL

Reduce autonomy where authority carries real impact.

01DiscoverFind the agent and tools.
↓
02UnderstandMap identity, permissions, and effective authority.
↓
03ControlApply policy and approval to sensitive actions.
Agent Identity & Permissions Runtime Security

AUTHORITATIVE GUIDANCE

Related AI security guidance.

These primary resources provide shared language for agentic threats, AI risk management, and adversarial testing. They do not imply endorsement of Eyrane.

OWASP AGENTIC AIAgentic AI threats and mitigations.NIST AI RMFAI risk management guidance.MITRE ATLASAdversarial tactics and techniques for AI systems.

COMMON QUESTIONS

Questions about excessive agency.

What is excessive agency in AI?

Excessive agency is a security risk in which an AI agent has more autonomy, functionality, or ability to take actions than is necessary for its intended task.

Why is excessive agency dangerous?

Excessive agency is dangerous because an agent can make sensitive or unintended decisions and execute them without enough human review or policy enforcement.

How is excessive agency different from excessive permissions?

Excessive agency concerns autonomy and independent action. Excessive permissions concern the systems, data, and actions an agent can technically access.

What is AI agent autonomy?

AI agent autonomy is the degree to which an agent can decide and execute steps toward a goal without human approval.

Should AI agents be fully autonomous?

Full autonomy is not appropriate for every task. Higher-impact actions generally need narrower permissions, stronger context, and stronger approval controls.

How can companies limit AI agent autonomy?

Companies can limit autonomy by reducing functionality, requiring approval for sensitive actions, defining task boundaries, applying runtime policy, and testing behavior.

What is human-in-the-loop security?

Human-in-the-loop security places human review between an agent decision and a high-impact real-world consequence when the action justifies that friction.

How does least privilege reduce excessive agency risk?

Least privilege reduces the tools, systems, data, and actions available to an agent, limiting the impact of autonomous mistakes or manipulation.

How does MCP affect agent autonomy?

MCP can expand the tools an agent can invoke. Security teams should understand which tools are available and which may be used autonomously for a given task.

How does prompt injection interact with excessive agency?

Prompt injection can manipulate agent behavior. Excessive autonomy can let that manipulation become a sensitive action before a person reviews it.

Which AI agent actions should require approval?

Actions involving financial transfers, destructive changes, external data movement, production systems, or significant customer impact are common candidates for review.

How can agents be tested for excessive agency?

Red teams can test whether an agent uses unnecessary tools, exceeds its task, bypasses approval, retries after denial, or chains actions into an unsafe outcome.

RELATED SECURITY

Continue exploring agent authority.

Overprivileged Agents Tool Misuse Prompt Injection Indirect Prompt Injection Data Exfiltration MCP Security Risks What is AI Agent Security? What is Agentic Security?

EXCESSIVE AGENCY

Give agents enough authority to work — not enough to create unnecessary risk.

Limit permissions, autonomy, and tool access while applying stronger controls to high-impact actions.

Explore Runtime SecurityGet Early Access