A team sets up an AI agent to keep their shared documents tidy. It only needs to read files and suggest summaries. The tool they install to connect it, though, can also edit and delete. Nobody notices, because the agent never needed to.
Until one day it does something nobody asked for.
That scenario isn't fanciful. It's close to an example OWASP itself uses: a tool meant to read documents that also includes the ability to modify and delete them.
The risk has a name
OWASP calls it excessive agency: when damaging actions are taken in response to unexpected, ambiguous or manipulated model output.
Notice the word manipulated. An agent can be misled by a confusing request, by its own mistakes, or by hidden instructions in something it reads, a problem we covered in prompt injection, explained. Excessive agency is what turns those mistakes into damage.
OWASP traces it to three causes: excessive functionality, excessive permissions and excessive autonomy. In plain words, the agent can do too many things, reach too much, and act without anyone checking.
Three questions before you switch an agent on
What can it do? Strip each connection down to the job. If an agent summarises email, it should read mail, not delete or send it.
What can it reach? Give it its own account with the least access that works. An agent helping one person shouldn't quietly use an administrator's login that can see everyone's files.
What can it do alone? For anything hard to undo, such as payments, deletions, posts or messages to customers, OWASP recommends that a person approves high-impact actions before they happen.
Don't let the AI be its own security guard
The most important rule is easy to miss. Permissions should be checked by the systems the agent touches, not left to the model to decide whether an action is allowed.
Our reading: telling an agent in its instructions never to delete anything is a polite request. A database account that can't delete anything is a guarantee. Only one of those survives a clever attacker.
The boring answer is the right one
None of this is new. It's the same least-privilege thinking security teams apply to new employees and software. The difference is that an AI agent works faster, never gets tired, and can be talked into things. So give it the access of a trainee on their first day, and let it earn more.