OWASP Top 10 for LLM Applications
Security guidance covering excessive agency, prompt injection, sensitive information, and application controls.
← Back to Compute College
Compute College
Agent security and excessive agency
Limit what an AI agent can access, decide, and execute when tools or data are involved.
Plain-English definition
An AI system has excessive agency when it can do more than the task requires. Agent security narrows its tools, data, permissions, side effects, identity, and runtime so a mistake or malicious instruction cannot cause avoidable harm.
Memory trick: Least privilege is a system boundary, not a prompt sentence.
Why it matters
An agent can be influenced by untrusted content, confused by ambiguous goals, or wrong about a tool argument. Least privilege and independent enforcement reduce the consequences of those failures.
Simple example
A support agent can read a ticket and draft a response but cannot access payroll, change account ownership, or send a message without a separate approval. Its retrieval tool filters documents by the authenticated user’s permissions.
Example figures are illustrative calculations, not current quoted market prices.
Current example
Source material
Common mistake
The system prompt cannot carry the whole security model. Prompts can guide behavior, but authorization, data access, and irreversible action controls need independent enforcement.
Practical takeaway
What you can do with this
Inventory every tool and data source. Remove unused permissions, separate read from write, require approval for high-impact actions, and test malicious or conflicting instructions.
Decision check: if the model follows an untrusted instruction, what independent control prevents the worst possible action?
Compute College learning path
AI Engineering
Step 35 of 48: Agent security and excessive agency