An AI agent is useful because it can act: read your inbox, update a spreadsheet, post to social media, refund a customer. That’s also what makes it risky. OWASP, the security community that publishes widely used risk lists, calls the problem excessive agency: an AI system being able to do damage because something went wrong, whether a confused model, a badly worded instruction or a deliberately malicious message.
OWASP traces the cause to three things. Each one is a setting you control.
1. Too many tools
Only connect the tools the job needs. If an agent summarises email, it needs to read email. It doesn’t need to send, forward or delete. Remove tools you tried and no longer use.
2. Too much permission
Give each tool the narrowest access that works: read-only where possible, one folder rather than the whole drive, one mailbox rather than every mailbox. The NCSC’s advice on agentic AI is to apply least privilege (only the minimum access, for the shortest time) and to avoid long-lived credentials, revoking access when a task is done.
3. Too much autonomy
Decide in advance which actions a person must approve. A simple rule of thumb:
| What the agent does | Who decides |
|---|---|
| Reads, searches, summarises, drafts | Agent can go ahead |
| Changes internal records (tags, notes, draft documents) | Agent can go ahead, logged and reversible |
| Sends anything outside the business (emails, posts, messages) | A person approves each one |
| Spends money, refunds, signs up, deletes, shares files | A person approves each one, or it’s not allowed |
Don’t let the agent police itself
OWASP recommends enforcing permissions in the systems the agent connects to, not by asking the AI to behave. A line in the prompt saying “never delete files” is a hope. A read-only account is a control.
Plan to stop it
The NCSC says humans stay accountable for the decision to deploy an agent, the access it was given and its consequences. Before you switch an agent on, name who owns it, who approves its access, who watches what it does and who can switch it off, and make sure they know how. Rate limits help too: an agent that can send at most ten emails an hour can’t do much damage before someone notices.
A quick checklist
- Every connected tool is needed for this job.
- Every connection uses the narrowest permission that works.
- Anything external, financial or destructive needs a person to approve it.
- Permissions are enforced by the systems, not just the prompt.
- Actions are logged, and someone looks at the log.
- There is a named owner and a tested way to switch it off.
A prompt to help you do this
Replace the [BRACKETS]. Only paste data you’re allowed to share with the tool you’re using.
View promptI'm planning to give an AI agent access to some business tools. Help me apply least privilege.
I'm planning to give an AI agent access to some business tools. Help me apply least privilege.
The job I want it to do: [e.g. triage the support inbox and draft replies]
Tools and access I was going to give it: [e.g. Gmail full access, Google Drive, Slack]
1. For each tool, say what the job actually needs (read, write, send, delete) and the narrowest permission that would work.
2. List every action the agent could take that sends something outside the business, spends money, deletes or shares data, and say whether it should be blocked or need human approval.
3. Suggest a sensible rate limit for each external action.
4. Write a one-paragraph "owner and off-switch" note: who owns it, who reviews the logs, and how to disconnect it in an emergency.
Assume the agent will sometimes misunderstand instructions or read malicious content.Sources
- OWASP, "LLM06:2025 Excessive Agency" Security standard
- NCSC blog, "Thinking carefully before adopting agentic AI" (15 May 2026) Government guidance
- NCSC, Guidelines for secure AI system development Government guidance