Excessive agency

Giving an AI-enabled workflow more functions, permissions, data scope, or independent reach than its task requires, increasing the possible effect of an error or attack.

Excessive agency is a capability-design flaw. A meeting-note summarizer may need to read one meeting and write a draft record; company-wide directory access, calendar deletion, and unrestricted email sending add reach without serving that task. If the model misreads a request or follows an injected instruction, those extra capabilities become additional paths to harm. The effect depends on what each permission can change, how broadly it applies, and which recovery controls exist.

Builder example

Least privilege applies to agent tools and credentials just as it does to other software identities. A customer chatbot does not need a general database write credential when a narrow support operation will do. A code reviewer does not need deployment access to comment on a patch. Smaller tools, scoped records, transaction limits, destination allowlists, and short-lived credentials reduce the consequence of a bad decision without requiring a person to supervise every call.

The user needs summaries from a Drive folder, but the connector also grants edit and delete permissions.

Use read-only scopes, separate write actions, and require human approval for destructive operations.

Common confusion: Excessive agency is not the attack itself and does not imply that every powerful agent is improperly designed. The question is whether each capability is necessary for the defined job and bounded to the smallest useful effect.