A risk model for AI agents that evaluates capability, autonomy, and permissions as separate amplifiers of harm. It is useful because agent damage often emerges from how these factors combine at runtime, not from any single property in isolation.
What Excessive CAP Means in AI Agent Risk Modeling
Excessive CAP is a way to describe when an AI agent becomes dangerous because its capability, autonomy, and permissions combine at runtime in an outsized way. The model is useful because harm can emerge from the interaction of those amplifiers, not from any one factor alone.
Why the CAP Lens Matters
The CAP framing helps separate three dimensions that are often conflated in practice. Capability is what the agent can do, autonomy is when and how independently it acts, and permissions are what it can reach or change. A system may be safe on one axis and still be risky overall if the other two are strong enough.
This is especially important for agents that can plan, call tools, and continue operating with little human intervention. A narrow but highly privileged agent can be more dangerous than a broadly capable but tightly constrained one, because the practical risk comes from what it can execute, not just what it can reason about.
How Excessive CAP Changes the Risk Profile
As CAP rises, small mistakes become easier to amplify into security events, operational disruptions, or unintended actions. The key concern is not simply that the agent is powerful, but that its power is paired with enough autonomy and access to turn decisions into real-world effects.
In this model, permissions act as the force multiplier, autonomy as the trigger, and capability as the means. That combination can expand blast radius, reduce the chance of timely intervention, and make harmful actions harder to contain once execution begins.
For example, a system with tool access, long-lived context, or delegated authority can perform actions that a human would normally gate manually. The CAP lens makes that risk easier to reason about because it treats authority, reach, and execution capacity as separate variables rather than a single vague notion of “agent power.”
Using CAP for Governance and Control Design
CAP is most useful when you need to decide where to place constraints, review points, and approval boundaries. It encourages designs that keep capability from outrunning governance, and permission from outrunning intent. That makes it a practical lens for agent design reviews, access scoping, and safety boundaries around autonomous workflows.
It also helps teams avoid false comfort from partial controls. Limiting autonomy without reducing permissions can still leave a dangerous execution path, while reducing permissions without questioning capability may leave the agent effective in ways the organisation did not intend. A strong CAP posture aligns all three dimensions instead of optimising one in isolation.
Risk and Threat Considerations
Excessive CAP creates a material risk because harmful outcomes scale when an agent has enough ability to act, enough freedom to decide, and enough access to make those decisions matter. The concern is not just accidental misuse, but also adversarial exploitation of the agent’s runtime authority.
Failure mechanism: An attacker or flawed instruction can exploit the agent’s combination of capability, autonomy, and permissions to trigger actions that would otherwise require human judgment or manual approval. Once those permissions are exercised, the agent may accelerate privilege abuse, data exposure, or destructive operations faster than a person can intervene.
Impact: The result can be broader blast radius, stronger persistence of bad actions, and harder recovery after compromise or error. In high-trust environments, excessive CAP can turn a single bad decision into a multi-system incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack surface, NIST AI RMF, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the technical controls, and ISO/IEC 42001:2023 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Excessive CAP centers on agent authority and permission amplification. |
| Recommendation — Constrain agent privileges so autonomy cannot turn into unreviewed authority. | ||
| NIST AI RMF | GOVERN — GOVERN | CAP is an AI governance lens for balancing capability, autonomy, and permissions. |
| Recommendation — Define oversight boundaries for agent capability, autonomy, and access. | ||
| ISO/IEC 42001:2023 | 6.1 — Actions to Address Risks and Opportunities | Excessive CAP is a risk treatment issue for AI deployment and control design. |
| Recommendation — Assess agent risk before expanding autonomy or permission scope. | ||
| NIST CSF 2.0 | PR.AA-05 — Least Privilege | CAP risk rises when an agent holds more permissions than its task needs. |
| Recommendation — Apply least privilege to limit the agent’s reachable actions. | ||
| NIST Zero Trust (SP 800-207) | PL — Policy Decision and Enforcement | CAP depends on separating decision authority from execution authority. |
| Recommendation — Enforce policy boundaries between agent decisions and allowed actions. | ||
Practitioner Guidance
What to watch for: Treat CAP as a design-review question whenever an agent can both decide and act. The strongest warning sign is a system whose capability, autonomy, and permissions all rise together without a compensating control boundary.
Governance implication: Review authority, execution scope, and intervention points as separate approvals, not one combined approval. That makes it easier to notice when an agent is being granted more practical power than the use case justifies.