What you’ll be able to do
- Separate excessive functionality, excessive permissions, and excessive autonomy using one agent.
- Place tool allow-lists, schemas, and credentials in application code rather than in model text.
- State the blast radius of a tool identity in terms of whose money, mail, or records it can change.
- Refuse a model sentence as if it were an authorization decision.
Agency is the tools, the credential, and the freedom to act
LanePay is not “an LLM.” It is a model plus the tools a developer attached and the credentials those tools present to mail and to the bank. OWASP Top 10 for LLM Applications 2026 names the resulting failure LLM03:2026 Excessive Agency. In the 2025 list this risk was LLM06:2025. The 2026 list reuses that number for a different risk: LLM06:2026 is Unbounded Consumption. This lesson teaches from the 2026 PDF and the GenAI repository. The interactive portal at genai.owasp.org/llm-top-10/ may still show 2025 labels. Excessive agency is what lets unexpected, ambiguous, or manipulated model output become a damaging action. OWASP splits the root cause into excessive functionality, excessive permissions, and excessive autonomy.
Functionality is which functions exist: read one mailbox, or also send mail and create payees. Permissions are the credential behind the tool: a read-only mailbox scope, or a finance-admin token that can debit any vendor. Autonomy is whether a high-impact call runs because the model asked, or only after an independent check. Least privilege from the foundations path applies to the tool identity, not to the prose in the system prompt.
Worked tools: what LanePay can actually touch
Today’s synthetic build offers three tools. read_invoice_mail uses a mailbox credential that can read every finance inbox, not only carrier-invoices. create_payee can insert a routing number into the vendor master. release_payment can send an ACH debit with the shared finance-admin credential, and the model may call it when its draft looks confident. That is a wide blast radius: one hostile email can nominate a payee and move money for every vendor the admin credential can reach.
A smaller design keeps the read tool on one mailbox and one folder, drops send and delete from that tool, and gives release_payment no credential at all until a separate executor runs. Open-ended tools such as “run a shell command” or “fetch any URL” are the wide case of the same mistake. OWASP’s prevention list is concrete: minimize the tool set, minimize each tool’s functions, avoid open-ended tools, minimize the tool’s permissions, execute in the user’s own authorization context, and put the allow-or-deny decision in policy code. Sanitizing the model’s sentence is a different control. It does not replace a scoped credential.
| Tool | Function it actually has | Credential | Blast radius |
|---|---|---|---|
| read_invoice_mail | Read every finance mailbox | Shared mailbox reader | Confidentiality of payroll and executive mail, not only carrier invoices |
| create_payee | Insert or replace a routing number | Vendor-master writer | Integrity of every vendor the writer can update |
| release_payment | Send an ACH debit | Finance-admin | Availability of cash for any vendor that credential can pay |
Model text is not the authorization decision
If LanePay prints “I checked policy and the payment is allowed,” that sentence is another model output. Authorization is a decision by the tool, by a policy point between the tool and the bank, or by the bank itself, using an authenticated identity and a written scope. Complete mediation means every release_payment call hits that check, including calls the model makes after reading mail.
Logs still matter. Record the tool name, the caller identity, the arguments, and the allow or deny result, with the same provenance habits as the evidence lesson. A log of a model’s intention is not a log of a debit. The Agentic SOC guide shows one way to keep connectors read-only until a separate executor exists. LanePay needs the same split, aimed at mail and payments rather than at alerts and firewalls.
CHECK YOUR JUDGMENT
A designer wants LanePay to “move fast” by letting the model call release_payment whenever it is sure, using the finance-admin credential already stored in the prompt, because the system prompt lists allowed vendors. What should Maya require before any pilot?
NEXT FIELD LESSON