Excessive agency turns an LLM system into a governed actor that can affect downstream workflows, while prompt leakage exposes the instructions that shape those actions. Together they shift the control problem from model output quality to delegated authority, hidden logic, and behaviour at runtime. That is an identity governance issue as much as a security one.
What makes excessive agency a governance problem?
Excessive agency changes an AI system from a passive generator into a delegated actor. Once the system can take actions, call tools, move data, or trigger workflows, governance has to cover who authorised those powers, under what conditions, and with what limits. That is why the issue sits at the boundary of ai governance, access control, and operational accountability.
The practical shift is from judging output quality to governing authority. If the same prompt can now approve requests, create tickets, send messages, or change records, the system needs clear task scope, approval boundaries, and revocation paths. Without those, the organisation is no longer reviewing suggestions, it is managing a decision-maker with execution power.
That is why AI Agent Authorisation Guide is directly relevant: it frames least privilege, task-scoped access, per-action decisions, and human approval as the controls that keep delegated behaviour bounded. The same logic is reinforced by Privileged Access Management Guide, which covers just-in-time access, session control, and zero standing privilege for people and machines alike.
Why prompt leakage changes the security model
Prompt leakage matters because instructions are part of the control surface. When system prompts, policy text, hidden guardrails, or orchestration logic leak, attackers and insiders gain a map of how the system is meant to behave, what it is optimised to reveal, and where its boundaries are weak. That is not just information exposure, it is exposure of the decision logic behind the behaviour.
Leaked prompts can enable jailbreak refinement, policy evasion, prompt injection tuning, and targeted social engineering against the surrounding workflow. The risk is amplified when the prompt contains operational details, approval rules, tool names, or escalation cues, because those details help an attacker move from generic abuse to precise manipulation. In governance terms, leakage undermines transparency in the wrong direction: the organisation learns that the system is exposed only after the hidden rules have already been reconstructed.
The best supporting control lens is to treat prompts, policies, and routing logic as governed configuration, not casual text. Enterprise AI Copilot Security Guide is useful here because it addresses oversharing, connector governance, and monitoring of AI use, while Agentic AI Security Policy Template covers registration, ownership, oversight, tools, and retirement as part of the control model.
Why the two issues combine into a runtime governance risk
Excessive agency and prompt leakage are worse together because one expands what the system can do while the other reveals how to influence or subvert those actions. That combination creates a runtime governance problem, not just a model safety problem. The organisation has to assume that hidden instructions may be discoverable and that exposed authority may be abused.
At that point, standard content moderation is insufficient. Governance has to ask whether the system can be induced to exceed its intended scope, whether its actions are observable and attributable, and whether a failure can be contained before it propagates into downstream systems. This is the same reason AI governance increasingly borrows from identity and privileged access thinking: the issue is not only what the model says, but what it is allowed to do.
Agentic AI Identity Risk Board Briefing is a good navigation point for board-level questions, metrics, and decision framing, and The State of NHI & AI Agent Breach Report 2026 helps anchor the discussion in observed abuse patterns involving leaked secrets, compromised service accounts, and attack paths that exploit delegated access.
Risk and Threat Considerations
Excessive agency increases blast radius because an AI system can trigger real business actions, not just generate text. Prompt leakage increases the chance that those actions can be manipulated, bypassed, or replayed in ways the organisation did not intend.
Failure mechanism: An attacker or careless user extracts hidden instructions, then uses that knowledge to steer the system into approving, revealing, or executing actions beyond its intended scope.
Impact: The result can be unauthorized workflow changes, data exposure, policy bypass, and loss of confidence in whether the system’s actions were properly governed or attributable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Excessive agency is fundamentally about overbroad agent authority. |
| ASI01 — Agent Goal Hijack | Prompt leakage enables attackers to steer agents away from intended goals. | |
| Recommendation — Bind agent actions to least-privilege, approval-gated authorization. Harden prompts and guardrails against goal manipulation and injection. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | AI agents are non-human actors whose excess authority creates governance risk. |
| Recommendation — Reduce standing access and scope every NHI to the minimum required. | ||
| NIST AI RMF | GV.1 — Govern, Map, Measure, and Manage | AI governance must define authority, oversight, and controls for agent behavior. |
| Recommendation — Map AI authority boundaries and measure whether runtime controls actually constrain action. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Excessive agency is a least-privilege failure when AI can act beyond need. |
| AU-2 — Audit Events | Runtime governance depends on logging agent actions and privileged decisions. | |
| Recommendation — Restrict AI and agent permissions to the minimum required for each task. Log agent decisions, tool use, and approval outcomes for review and incident response. | ||
Practitioner Guidance
What to verify: Confirm that every action-capable model, agent, or copilot has explicit authority boundaries, an owner, and a revocation path. If the system can touch production data, send messages, or approve work, treat it like an access-bearing actor rather than a documentation aid.
Decision rule: If the prompt or policy text would materially help an attacker route around controls, assume it is sensitive governance material and protect it accordingly. If the system’s instructions are needed to operate the control plane, limit exposure to the smallest audience that needs them.
Common mistake: Teams often secure the model endpoint but ignore the delegated actions, shared prompts, and downstream connectors. That leaves the most important risk untouched, because the harm comes from what the system can do at runtime, not from the text it produces in isolation.
Practitioner takeaway: The governance question is not whether the model is clever, it is whether its authority is bounded, its instructions are protected, and its actions remain observable enough to stop misuse before it becomes business impact.