OWASP Top 10 for LLM Applications
Security guidance covering excessive agency, prompt injection, sensitive information, and application controls.
← Back to Compute College
Compute College
Agent security and excessive agency
Limit what an AI agent can access, decide, and execute when tools or data are involved.
Plain-English definition
An AI system has excessive agency when it can do more than the task requires. Agent security narrows its tools, data, permissions, side effects, identity, and runtime so a mistake or malicious instruction cannot cause avoidable harm.
Memory trick: Least privilege is a system boundary, not a prompt sentence.
Why it matters
An agent can be influenced by untrusted content, confused by ambiguous goals, or wrong about a tool argument. Least privilege and independent enforcement reduce the consequences of those failures.
- The design makes a hidden tradeoff measurable before it reaches users.
- A clear boundary reduces retries, unsafe actions, or unnecessary capacity.
- The operating choice should be tested against the workload rather than assumed from a demo.
Simple example
A support agent can read a ticket and draft a response but cannot access payroll, change account ownership, or send a message without a separate approval. Its retrieval tool filters documents by the authenticated user’s permissions.
- The example names the input, decision, and expected boundary.
- A deterministic or human checkpoint owns the part a model should not guess.
- The result can be measured with quality, latency, safety, and cost metrics.
Example figures are illustrative calculations, not current quoted market prices.
Current example
Primary reference
This source explains the method or risk boundary. It does not replace testing the actual model, data, provider, and workload conditions in production.
Source discipline: examples on this page are illustrative; measure the real workload before making a release or capacity decision.
Common mistake
The system prompt cannot carry the whole security model. Prompts can guide behavior, but authorization, data access, and irreversible action controls need independent enforcement.
Practical takeaway
What you can do with this
Inventory every tool and data source. Remove unused permissions, separate read from write, require approval for high-impact actions, and test malicious or conflicting instructions.
- Start with a narrow workflow and explicit failure boundary.
- Instrument the path before optimizing it.
- Review the design whenever model, tool, traffic, or policy changes.
Decision check: if the model follows an untrusted instruction, what independent control prevents the worst possible action?
Compute College learning path
AI Engineering
Step 35 of 48: Agent security and excessive agency