Topic 1

How much can a wrong step do?

Every lesson in this module has made the agent more capable or more reliable. This one decides how far it's allowed to go. The working assumption: the model will sometimes do the wrong thing, through a mistake, an ambiguous request, or an attacker's instructions. The design question is how much harm a wrong step can do.

Predict first

Your agent only needs to look up orders. It's given a general `run_sql` tool and the database admin account. An attacker's text in a support ticket tells it to delete the orders table. What decides whether that's possible?

Whether the model notices the attackThe system promptThe temperatureWhat the tool and account allow: with a general SQL tool and admin rights, the delete is possible; with a read-only lookup tool, it isn't

Three ways to give an agent too muchStep 1 / 4

Scroll sideways to see the whole diagram

OWASP's LLM06:2025, Excessive Agency, names three root causes. First: tools with more functionality than the application needs.

Text version

OWASP's LLM06:2025, Excessive Agency, names three root causes. First: tools with more functionality than the application needs.
Second: tools that reach downstream systems with more permissions than their task requires.
Third: high-impact actions taken without independent verification or approval.
OWASP's point: excessive agency enables damaging actions in response to unexpected, ambiguous or manipulated outputs, whatever caused them. Limit the agency, and every cause does less harm.

The OWASP Top 10 for LLM Applications (2025) calls this risk Excessive Agency (LLM06): it enables damaging actions in response to unexpected, ambiguous or manipulated model outputs, whatever caused the malfunction. It names three root causes:

Excessive functionality: tools that can do more than the application needs.
Excessive permissions: tools with more access to downstream systems than their task requires.
Excessive autonomy: high-impact actions without independent verification or approval.

Each maps to a harness decision you've met: which tools exist (lesson 1), which actions need a person (lesson 2), and what code checks before an action runs. OWASP adds that logging, monitoring and rate limiting don't prevent excessive agency, but they limit the damage.

Quick check

Which is excessive autonomy rather than excessive functionality or permissions?

An agent that can wire money without any check or approval, even though wiring money is part of its jobA shell tool when the agent needs one commandWrite access when the agent only readsA tool with many parameters