Excessive Agency
Excessive agency is the condition where an AI system holds more functionality, permission or autonomy than its task requires, so that a model error or a manipulated input produces a consequential action instead of a wrong answer.
The Damage Scales With Permission, Not With Error Rate
A model that answers incorrectly produces bad text. An AI agent that answers incorrectly while holding write access to a production database produces a bad outcome. Excessive agency describes the distance between what an agent needs in order to do its job and what it can reach. OWASP named it in the Top 10 for LLM Applications because the failure mode belongs to the integration around the model, so no amount of model improvement removes it.
Three Conditions Produce It
Excessive functionality comes from handing an agent tools it has no task for, often because a plugin or MCP server exposes its full surface and nobody narrowed it. Excessive permission comes from credentials scoped to the developer who built the agent instead of the work the agent performs, which is the pattern covered under agent permissions and scoping. Excessive autonomy comes from removing the approval step on actions that change state, leaving the agent free to commit the organization to something without review.
Why It Pairs With Injection
Excessive agency is what converts prompt injection from a curiosity into an incident. An injected instruction reaching an agent with read-only access to public documentation produces nothing of consequence. The same instruction reaching an agent that can send mail, open pull requests and move money produces the consequence directly. Attackers do not need to compromise the model when the permissions already grant what they want.
Measuring It Instead of Describing It
Excessive agency resists severity labels because the same configuration carries different exposure in different environments. Counting the standing grants an agent holds, and pricing the loss each one could produce, turns the condition into a number that can be compared against other open items. Kovrr's work on translating the OWASP agentic list into expected loss sets out how that calculation runs.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
