Excessive Agency
Excessive agency is a failure mode where an AI agent is given too much capability, autonomy, or access—allowing it to take actions with a broader impact than is appropriate or intended.
Why this matters for AI agents
Excessive agency is recognized by OWASP as a top AI application security risk. It describes the condition where agent capability exceeds appropriate limits, enabling consequential unintended actions.
How AgntID relates
AgntID's per-tool, per-task access model directly addresses excessive agency by constraining each agent's action surface to only what is needed for the current task.
The static IAM gap
Broad IAM roles create the conditions for excessive agency. Without per-task, per-tool constraints, agents inherit the full capability of their assigned role.
Related phrases
Frequently asked questions
What is excessive agency in AI systems?
Excessive agency is a failure mode where an AI agent is given too much capability, autonomy, or access—allowing it to take actions with a broader impact than is appropriate or intended.
Is excessive agency recognized as a formal security risk?
Yes. OWASP lists excessive agency as a top risk in AI applications. It describes the condition where agent capability exceeds appropriate limits.
How does AgntID address excessive agency?
AgntID's per-tool, per-task access model constrains each agent's action surface to only what is needed for the current task, preventing excessive agency by default.
Secure every agent tool call at execution time.
AgntID gives infrastructure teams scoped, ephemeral access control for AI agents without replacing IAM, MCP servers, tools, or agent frameworks.