← All Terms

Excessive Agency

An OWASP risk category for AI systems given more functionality, permissions or autonomy than their task needs, so that a manipulated or mistaken model can cause real damage.

Agentic AI

Excessive agency is entry LLM06 in the OWASP Top 10 for LLM Applications 2025. It describes an AI system that can call tools or act on other systems with more reach than its job requires. OWASP traces it to three root causes: excessive functionality, excessive permissions and excessive autonomy.

The risk is less about the model being wrong and more about what happens when it is. A model that can be steered by injected text, or that simply misreads a request, will do damage in proportion to what it is allowed to touch and whether anyone checks before it acts. OWASP’s mitigations follow from that: minimise the tools and their permissions, run tools in the user’s own security context, and require human approval for high-impact actions.

The agentic version of the idea, which OWASP calls least agency, treats autonomy as something an agent earns per task. Approval controls only count if people read them; an approval step that users switch to “always allow” provides no protection.

Read more on this
Governance & Risk

How AI Agents Turn Low-Rated Security Findings Into a Serious Risk

Security reviews score findings one at a time and assign each to the team that owns the asset. An AI agent connects those assets by design, so three Low findings can add up to one critical path that no team owns. FIRST's CVSS guidance already says how to score chains, and OWASP's agentic guidance says how to break them. Here is how to govern the path as well as the parts.