Excessive agency is granting a model more permission, autonomy or reach than its task requires.
It appears as too many tools, credentials that are too broad, or no human approving anything.
A support agent that can only read tickets is a small problem once it is compromised.
The same agent holding a delete endpoint is a much larger one.
Scope every tool to the narrowest action that still completes the job.
Excessive agency is granting a model more autonomy, permission or reach than the task genuinely requires.
It is a design fault rather than an attack, but it decides how badly every attack ends.
The damage a successful injection can do is bounded by what the model was allowed to do in the first place.
It usually arrives in one of three shapes.
Too much functionality, where a tool exposes far more than the single action the agent needs.
Too much permission, where a database credential can write and delete because reusing it was easier.
Too much autonomy, where an irreversible action runs with nobody approving it.
A support agent that can only read tickets is a contained problem when it is compromised.
The same agent holding a refund endpoint and a delete endpoint is a very different incident.
Scope each tool to the narrowest action that still completes the job.
Prefer a specific function over a general one, so send a password reset rather than send an arbitrary email.
Give every tool its own credential, which makes the real permission surface visible in code review.
Require a person to approve anything that spends money, deletes data or contacts a customer.
Ask what a fully compromised agent could do with the tools you handed it, and design for that answer.
Capability you never granted cannot be stolen.
One question on this card. Every option explains itself once you pick, right or wrong.
16 concepts in this module, then a graded test with every answer explained.