Digital Lexicon Hub

An AI-system vulnerability in which excessive functionality, permissions or autonomy enable damaging actions from erroneous or manipulated outputs.

As AI agents get access to email, files, payments and business systems, excessive agency can turn one wrong or manipulated output into a real business action, such as sending data or deleting records.

A support agent built on an LLM is given read-only access to order data, a refund tool limited to $100, and a rule that refunds above that amount or account deletions need human approval, with all tool calls logged.

Prompt instructions alone do not limit agency; controls must be enforced in permissions and code. Tight limits can reduce usefulness, and human approval steps lose value if reviewers approve requests without checking them.

OWASP describes three root causes: excessive functionality, where an agent has tools it does not need; excessive permissions, where tools have more access than required; and excessive autonomy, where high-impact actions run without independent checks. Mitigations include least privilege, narrow tools, user-scoped credentials, human approval for sensitive actions, rate limits and monitoring.