Esta nota todavía no está traducida, así que se muestra la fuente en inglés.
Excessive agency
Mechanism: task authority → narrow capability → bounded blast radius
allowed = {"search", "draft"}
print("deny" if "delete" not in allowed else "allow")
Run with python3; expected output is deny. Give every agent its own identity, scoped tools, semantic validation, budgets, approval tiers, and a kill switch; prompts are not enforcement.
Sources
- OWASP LLM06: Excessive Agency — authority and permission risks.
- NIST AI RMF — lifecycle controls.
Excessive agency is the risk of giving an AI system too much power. The model might be tricked, confused, or wrong, but the damage comes from the permissions and actions the system allowed it to take.
Agency dimensions
| Dimension | Risky default |
|---|---|
| Tool access | every tool exposed to every agent |
| Credentials | agent acts with a human admin token |
| Autonomy | high-impact actions execute without approval |
| Budget | unlimited loops, tokens, API calls, or spend |
| Scope | agent can operate across tenants, files, or accounts |
| Memory | past instructions influence future tasks without review |
Controls
- Give each agent a narrow role and allowlist only required tools.
- Use service identities with scoped credentials, not broad human accounts.
- Validate tool arguments against policy and the user's original request.
- Gate irreversible, external, costly, or regulated actions with human approval.
- Cap iterations, spend, retries, and runtime.
- Make every action auditable and reversible where possible.
Autonomy tiers
| Tier | Example |
|---|---|
| Suggest | draft a plan, no side effects |
| Prepare | produce an action for human review |
| Execute reversible | update a draft, stage a change, create a ticket |
| Execute high impact | send, delete, purchase, deploy, transfer funds |
Each tier needs a different permission and approval model.
Pitfall
Do not rely on the model to decide whether it deserves more permissions. Permission boundaries belong outside the model.
Connects to: autonomy and least privilege · guardrails and HITL · agent evals