What it means
Excessive agency shows up when a model-using application can change the world more broadly than the task requires. OWASP Top 10 for LLM Applications 2026 (Version 2026) lists it as LLM03:2026. The 2025 list called it LLM06. LLM06:2026 is Unbounded Consumption. The portal may still show 2025 labels; this guide follows the 2026 PDF. The failure is excessive functionality (tools that can send, delete, or pay when the task is to read), excessive permissions (a shared admin credential behind a narrow-looking tool), or excessive autonomy (a high-impact call that runs because the model asked). Unexpected or injected output can trigger any of those. The control sits in application code: a short tool list, a strict argument schema, a narrow credential, and a policy check on every call. A system prompt does not grant or withhold that credential.
AN ILLUSTRATIVE SCENARIO
A freight inbox that can pay vendors
A freight company pilots an assistant that reads one carrier inbox and drafts invoice payments. The mail tool can also send and delete, and the payment tool uses a company-wide finance-admin credential. A carrier message tells the assistant to change a routing number and release the balance. The redesign keeps a read-only tool on that mailbox, lets the model emit a draft only, and allows a separate executor to pay only the payee and amount in an unexpired human approval.
Put it to work
- List every tool the application can call, the functions inside each tool, and the credential each call presents. Write the blast radius as whose mail, records, or money that credential can change.
- Drop functions the task does not need, replace open-ended tools with specific ones, and check every call in policy code.
- Require a named person to approve high-impact or hard-to-reverse actions after seeing the exact arguments, and log the tool call separately from the model’s draft.
How to check your work
In a synthetic test, confirm a hostile message cannot create a payee or release a payment, a legitimate draft still appears for the clerk, and the payment credential’s effective permissions match the single approved debit.
Connect the ideas
- Prompt injection
An attack that inserts instructions into model input so the model follows attacker text instead of the developer’s policy.
- Least privilege
Granting each identity only the actions, objects, and time window required for the current job.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.