Lesson 6 · 7 topics · 24 min · intermediate

Bounded Autonomy: Limits, Permissions and Sandboxes

You will be able to

Name the three root causes of excessive agency (functionality, permissions, autonomy) and limit each.
Set stopping conditions on steps, cost, time and repeated actions, and end limited runs cleanly.
Design narrow tools with least privilege that act with the user's own permissions.
Enforce a per-action policy in code that checks arguments, not just tool names.
Treat tool output as untrusted input, and block harmful outcomes rather than relying on detecting attacks.
Recognise the lethal trifecta (private data, untrusted content, external communication) and break it.
Run agent-generated code in a sandbox.

Your review

Sign in to keep your quick-check answers. The ones you miss come back for review after 1, 3 and 7 days, until they stick.

LLM06:2025 Excessive Agency (OWASP Top 10 for LLM Applications 2025) · OWASP Gen AI Security Project, 2025
OWASP Gen AI Security Project. Used: Description; Prevention and Mitigation Strategies (fetched 2026-10-23). Open source
The lethal trifecta for AI agents: private data, untrusted content, and external communication · Simon Willison, 2025
Simon Willison. Used: Fetched 2026-10-23. Open source
Building effective agents · Erik Schluntz & Barry Zhang (Anthropic), 2024
Erik Schluntz & Barry Zhang (Anthropic). Used: "Agents" (fetched 2026-10-23). Open source
AI Engineering · Chip Huyen, 2025
Chip Huyen. O'Reilly. Used: Ch. 6 "RAG and Agents": "Tools" > "Capability extension", "Write actions".

You will be able to

Name the three root causes of excessive agency (functionality, permissions, autonomy) and limit each.

Set stopping conditions on steps, cost, time and repeated actions, and end limited runs cleanly.

Design narrow tools with least privilege that act with the user's own permissions.

Enforce a per-action policy in code that checks arguments, not just tool names.

Treat tool output as untrusted input, and block harmful outcomes rather than relying on detecting attacks.

Recognise the lethal trifecta (private data, untrusted content, external communication) and break it.

Run agent-generated code in a sandbox.

Sources

LLM06:2025 Excessive Agency (OWASP Top 10 for LLM Applications 2025) · OWASP Gen AI Security Project, 2025

OWASP Gen AI Security Project. Used: Description; Prevention and Mitigation Strategies (fetched 2026-10-23). Open source

The lethal trifecta for AI agents: private data, untrusted content, and external communication · Simon Willison, 2025

Simon Willison. Used: Fetched 2026-10-23. Open source

Building effective agents · Erik Schluntz & Barry Zhang (Anthropic), 2024

Erik Schluntz & Barry Zhang (Anthropic). Used: "Agents" (fetched 2026-10-23). Open source

AI Engineering · Chip Huyen, 2025

Chip Huyen. O'Reilly. Used: Ch. 6 "RAG and Agents": "Tools" > "Capability extension", "Write actions".