Context information

OWASP LLM06:2025: excessive agency

OWASP describes excessive agency as the risk created by unnecessary tool capabilities, permissions or autonomy. Its mitigations include narrowly scoped tools, downstream authorization checks and approval for high-impact actions. This is a reference for reviewing what an agent can do beyond generating text.

External source ↗

Provenance: OWASP Gen AI Security Project guidance
Updated: 2026-11-08T22:15:33.515622Z