Excessive Agency
The "agent" pattern hands the LLM tools — read email, send email, run code, post to Slack, query a database. Excessive agency is what happens when those tools are too powerful, too unconstrained, or scoped to the wrong principal. Prompt injection becomes wire-transfer fraud.
01What it is
A category of risk where the model has functionality, permissions, or autonomy that exceeds what the use case requires. Three sub-categories: excessive functionality (tools you do not need), excessive permissions (overly broad scopes), excessive autonomy (acts without human approval on irreversible operations).
02Why it matters
Agentic AI is moving from demo to production. Every new tool adds attack surface. A read-only research agent that can email is a phishing engine waiting for injection. A coding agent with broad GitHub access is a supply-chain attack vector. Severity scales with the blast radius of the tools.
03Attack vectors
- Confused-deputy — the agent acts on behalf of the user but uses tool credentials that have admin scope.
- Tool-description injection — an MCP server returns crafted tool descriptions that re-shape the agent's behaviour.
- Plan-injection — the attacker embeds a multi-step plan in the prompt that the agent executes blindly.
- Cross-tool composition — individually-safe tools combined produce unsafe outcomes (read file → send email).
- Cascading agency — agents that spawn sub-agents amplify the original injection.
04Defence patterns
- Least functionality — only expose the tools you absolutely need.
- Least permission — every tool runs with the original user's scope, not a service account.
- Human-in-the-loop on irreversible actions — wire transfers, deletes, external sends.
- Tool sandboxing — code execution in containers, file access through a virtual FS, network through an allowlist.
- Action logs + replay — every tool call recorded, reviewable, attributable.
- Rate limits per tool, per session — even if injected, blast radius is bounded.
05Detection
Signals to watch
Anomaly detection on tool-call sequences. Unusual tool combinations. Tool calls outside business hours. Tool calls that fail authorisation at the downstream service.
06India context
DPDP · RBI · CERT-In
For BFSI, RBI operational risk guidelines treat any autonomous action on customer accounts as a high-risk control point. SEBI CSCRF requires audit trail for every automated decision; AI agents must produce one. DPDP processor obligations apply to every tool call that touches personal data.