Risk · R-001 · Agentic & Autonomous Systems
Excessive agency in autonomous agents
An agent is given more functions, permissions or independence than its task requires, so an error, an ambiguous instruction or a manipulated input turns into a damaging action that no one approved.
- Severity
- High
- Audience
- Heads-of · Practitioner
- Frameworks
- Article 14 · AML.M0029 · LLM03
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it is
Excessive agency is a design condition, present before anything goes wrong. It has three forms: more tools than the task needs, broader permissions on those tools than the task needs, and more freedom to act without approval than the consequences justify. It is the parent of the more specific agentic risks in this category. Agent tool misuse and agent identity and privilege abuse describe what happens when the excess is used; this entry is about granting it.
How it happens
- An agent inherits a general-purpose tool, such as a shell or a full database connection, when it needed one narrow operation.
- Permissions are set for the most demanding task the agent might ever do and never reduced.
- Approval steps are removed to make a pilot run smoothly and are not restored for production.
- A capability added for one use case stays switched on for all.
Why it matters
The harm an agent can do is bounded by what it is able to do, whatever it was asked to do. With narrow agency, a successful prompt injection yields a wrong answer. With excessive agency it yields a deleted record, a payment or a message sent in the organisation's name.
Warning signs
- Agents hold write or delete permissions they have never used.
- No record states what each agent is permitted to do, or why.
- High-impact actions complete with no human approval step.
- Tool lists grow with each release and are never pruned.
Who owns it
The business owner of the agent is accountable for the scope of authority it is given. Engineering implements the limits. The second line challenges whether the scope is proportionate at approval and on change.
In practice
A bank deploys an agent to draft replies to customer complaints. To let it look up account history it is connected with the same credentials as a human case handler, which also permit refunds. A customer's message contains text that the agent reads as an instruction, and it issues a goodwill payment. The same pattern generalises to any agent connected to a system of record with a human's permissions.
Mitigating controls
Primary controls
- Approval gates for high-impact agent actions Preventive
- Requires human approval for high-impact or irreversible actions. Before an agent takes an action above a defined impact threshold, or one that cannot be reversed, a designated person reviews the exact action and approves or rejects it.
- Human-in-the-loop review Preventive
- A person reviews consequential outputs before they take effect. Consequential AI outputs and decisions are reviewed by a competent person, with the time, information and authority to change them, before they take effect.
- Least-privilege agent identity and permissions Preventive
- Limits the agent's permissions to what the task needs. Each agent has its own identity, with permissions scoped to its task and to the user it is acting for, short-lived and reviewed like any other entitlement.
Supporting controls
- AI system monitoring and logging Detective
- Logs what the agent did for review. Every production AI system is instrumented to record its inputs, outputs, errors and usage, with thresholds that raise alerts to a named owner who must act.
- Intended-use definition and use restrictions Directive
- Defines the scope the agent is allowed to act within. The approved purpose, users, population and conditions of use of each AI system are stated precisely, and any use outside them requires reassessment before it begins.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| EU AI Act | Article 14 | Human oversight Human oversight. |
| MITRE ATLAS | AML.M0029 | Human In-the-Loop for AI Agent Actions Human approval of agent actions. |
| OWASP Top 10 for LLM Applications | LLM03 | Excessive Agency The entry this risk is named for. |
Sources
- EU AI Act: Regulation (EU) 2024/1689 European Union (EUR-Lex) · official text
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project · framework
- MITRE ATLAS MITRE · framework
Related terms
How to cite
Axiom Verity (2026). Excessive agency in autonomous agents. Reference Library, R-001. https://axiom-verity.com/risks/excessive-agency. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.