Excessive Agency and Tool Risk

Fact-check status

Reviewed claim by claim on 2026-09-02 against the primary or official sources identified inline as S1 and S2. Recommendations are design guidance unless a cited standard makes them normative.

Key jargon

Term	Plain-language meaning
Excessive agency	Giving an AI system more functions, permissions, autonomy, or impact than its task requires. S1
Authorization	The decision that a specific identity may perform a specific action on a specific resource. S1
Confused deputy	A privileged component tricked into misusing its authority for another party. S1
Reversibility	How easily an action and its consequences can be undone. S1

Key concepts

Model intent is not authorization; every consequential tool request needs independent policy enforcement. S1
Reduce risk by limiting available tools, arguments, identities, duration, rate, scope, and transaction value. S1

Concept map

flowchart LR
    A["Model proposes action"] --> B["Bind user identity and scope"]
    B --> C["Authorize and confirm consequence"]
    C --> D["Execute minimally and record"]

Diagram semantics verified against S1 and S2 on 2026-09-02.

Agency risk grows with tool breadth, credential privilege, data reach, action irreversibility, autonomy duration, environmental uncertainty, and weak supervision. S1

Reduce agency

Give task-specific tools rather than a shell or universal API. S1
Use short-lived, scoped credentials bound to user/tenant. S1
Separate read, propose, approve, and commit. S1
Constrain targets and arguments with policy. S1
Sandbox generated code and network access. S1
Set step, cost, and effect budgets. S1
Preserve idempotency and outcome reconciliation. S1
Provide an independent kill switch. S1

Exercise

Replace a hypothetical run_any_command tool with five narrow capabilities. Define identity, resource constraints, and approval for each.

Source

OWASP Top 10 for LLM Applications