Excessive Agency: What OWASP LLM06 Means and How to Prevent It
Try it live
Watch Agentshield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
Excessive agency is the OWASP risk category, LLM06 in the 2025 Top 10 for LLM Applications, that describes an AI system taking a damaging or unauthorized action because it was given too much functionality, too much permission, or too much autonomy. It is the mechanism that turns a prompt injection from an annoyance into an incident. A model that can only produce text cannot do much harm when it is manipulated. An agent that can call tools, spend money, or change records can, and excessive agency is the name for that gap between what an agent is allowed to do and what it actually needs to do.
Where excessive agency sits in the OWASP list
In the OWASP Top 10 for LLM Applications 2025, published November 2024, excessive agency is LLM06:2025. One point of confusion is worth clearing up: in the older 2023 and 2024 lists it was numbered LLM08. If you see LLM08 Excessive Agency cited, that is the old list. In the 2025 list, LLM08:2025 is Vector and Embedding Weaknesses, a different risk. Cite it as LLM06:2025 for current work.
The three root causes
OWASP breaks excessive agency into three root causes, and the distinction matters because each has its own fix. An agent can suffer one, two, or all three at once. Each maps onto a control you can actually deploy, which is the subject of our guide to AI agent guardrails.
| Root cause | What it looks like | The control that removes it |
|---|---|---|
| Excessive functionality | The agent has tools or plugins it does not need for its task, often left over from testing | Give the agent only the specific functions its job requires; remove open-ended tools |
| Excessive permissions | The agent's credentials grant more access than its task needs, for example write access when it only reads | Least-privilege permissions scoped per agent, enforced downstream |
| Excessive autonomy | The agent executes high-impact actions with no human in the loop | Human approval on irreversible or high-impact actions |
The pattern is the same one behind most agent incidents. An agent is over-provisioned during development, the extra power is never trimmed, and later a crafted input steers the agent into using power it never needed. Consider an interview-screening agent that reads candidate submissions: it needs to read applications and write a score, nothing more. If it also holds a tool to send email or update the applicant-tracking system, a poisoned resume that injects instructions now has a path to act, not just to be read. Trim the agent to read-and-score and that path closes.
How excessive agency relates to prompt injection
Prompt injection and excessive agency are a pair. Injection is how an attacker gets a malicious instruction into the agent; excessive agency is what determines how much damage that instruction can do. You cannot fully prevent injection, because an agent that reads untrusted text can always be given text that tries to redirect it. So the durable defense is to assume injection will sometimes succeed and make sure a successfully injected agent still cannot reach anything dangerous. That is excessive agency control, and it is why it belongs at the center of an agentic AI security program rather than at the edge.
How to prevent excessive agency
OWASP's recommended mitigations line up with a least-privilege, human-gated, fully-logged approach. In practice:
- Minimize functionality. Give each agent only the tools it needs, and prefer narrow, single-purpose functions over broad ones. An agent that should read a calendar should not get a general shell.
- Minimize permissions. Scope the agent's credentials to the least access its task requires, and enforce authorization in the downstream system rather than trusting the model to stay in bounds. Our access control page covers the mechanics.
- Require human approval for high-impact actions. Keep a person in the loop for irreversible or rights-affecting actions, using the reversibility logic in when AI agents need human approval. Reserve it for the actions that matter, so reviewers do not fatigue.
- Enforce in the action path, not the prompt. Instructions in a system prompt are advisory; an agent can be talked past them. Controls that sit between the agent and the tool are not.
- Log and monitor every action. An immutable, attributed trail lets you catch an agent doing something outside its intended scope and prove what happened afterward.
Excessive agency is the highest-leverage risk to fix, because addressing it caps the blast radius of every other agent risk at once. For the broader taxonomy it sits inside, see our OWASP agentic AI threats writeup, which maps LLM06 to the agent-specific threat classes it feeds.
See the firewall block an attack live.
Drive the Threat Console and watch a real prompt injection get stopped, then put Agentshield in front of your own agents.
Keep reading