Excessive agency is a permissions question
OWASP's Excessive Agency covers damage from an LLM-based system being given too much functionality, too many permissions, or too much autonomy. The question is not whether the model is trustworthy; it is what it is able to do when it is wrong or manipulated.
Why it is like this
A model that can only produce text can only be wrong. A model that can call tools can act on being wrong, and prompt injection means the thing deciding may not be your user.
Not to be confused with
A reason not to build agents. It is a reason to scope their tools: fewer tools, narrower permissions, and human approval on whatever is irreversible.
In practice
The useful exercise is to read the tool list and ask what the worst correctly-executed sequence of calls would be. That is the system's actual blast radius, not the one in the design doc.
Source: OWASP Top 10 for Large Language Model Applications, 2025 — LLM06:2025 Excessive Agency. Read on .
The OWASP Top 10 for LLM Applications is © the OWASP Foundation and published under a Creative Commons licence; NIST AI 600-1 is a US Government work in the public domain. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation or NIST.
Say it back Check yourself
Name the three dimensions OWASP identifies in Excessive Agency, and the question to ask about a tool list.
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- Excessive functionality — more tools than the task needs
- Excessive permissions — tools that can do more than the task needs
- Excessive autonomy — acting without approval where approval is warranted
- Ask what the worst correctly-executed sequence of tool calls would do
All three are design decisions made before anything goes wrong, which is the only time they can be made cheaply.