Excessive agency

Definition

Excessive agency is the gap between what an agent can do and what its task needs: too many tools, too broad a permission on each, or too much autonomy before a person is consulted. It is not an attack by itself; it is the condition that turns a prompt injection, a hallucination or a bad plan into a deleted table, a sent email or a spent budget.

Agent frameworks default toward agency, because a capable demo is one that acts. Security has to add the three limits back: functionality (only the tools the task needs), permission (only the rows and actions those tools need), and autonomy (a broker or a human between a risky proposal and its execution).

How it manifests

• Tool use outside grants: a call to a tool the agent was never granted, or a proposal the policy denied that executes anyway.
• Intent-action divergence: the task is “summarize this week's tickets” and the trace contains a destructive or credential-access tool category.
• Gates that only sometimes fire: some privileged calls in a trace carry a broker decision and one does not.
• Repeated denials: the same agent keeps proposing what the policy keeps refusing, which is either a loop or a probe.
• Misdeclared risk: a call to records.drop_table labelled as a lookup so it slides past a category-based check.

How AsrielNetworks detects it

Five rules cover the shape of agency abuse: tools outside grants and execution after denial; a declared task category that diverges from the tool categories actually used; privileged MCP calls that executed with no broker decision where others were gated; repeated control failures in a window; and a declared tool class below the one the tool's name implies. Classification is escalate-only: a payload can raise a tool's risk class but never lower it, and the attempt to lower it is itself a finding.

• Unauthorized tool useai.tool.unauthorized · high
  Tools outside the agent's grants, policy-denied proposals, and execution after a denial.
• Intent-action divergenceai.intent_action.divergence · high
  Declared task category compared with the explicit tool category and side effects.
• Repeated security control failureai.control.repeated_failure · high
  Repeated policy denials or guardrail failures aggregated over a bounded window (3 in 60 minutes by default).
• Tool risk declared below its inferred classai.tool.risk_misdeclared · medium
  A tool call declared a category or governance class below what its name implies; declarations can escalate, never downgrade.
• Privileged tool call bypassed its gateai.mcp.approval_bypass · high
  A destructive- or secrets-class tool executed with no broker decision in a trace where other calls were gated.

References