Excessive agency is the control gap now shaping agentic AI risk

At a glance

What this is: raxIT Labs argues that the 2026 OWASP LLM Top 10 elevates Excessive Agency because real incident data shows agentic systems need deterministic mediation before actions execute.

Why it matters: IAM and security teams should treat agent permissions like live authorization decisions, because autonomous or semi-autonomous actions can create impact before human review ever happens.

By the numbers:

• The 2026 OWASP LLM Top 10 was checked against 7,714 real incidents.
• The methodology classified 6,639 of those incidents.
• Excessive Agency moved from rank 6 to rank 3 in the 2026 list.
• The final weighting used 75 percent vote and 25 percent incidents.

Context

Agentic AI changes the control problem because the system can choose an action, not just produce a response. In practice, that means the real security boundary moves from the prompt to the decision point that allows or blocks each action before it leaves the model.

That shift matters for identity governance because the agent's usefulness depends on delegated authority, tool access, and downstream permissions. Once the system can act on production systems, payment flows, or data stores, the question is no longer what the model said but what it was allowed to do.

Key questions

Q: What breaks when an AI customer service agent has too much authority?

A: The control model breaks when the agent can both fetch sensitive context and act on it without strong policy boundaries. In practice, that can turn a helpful support workflow into an over-trusted execution path, where incorrect refunds, account changes, or escalations happen before a human can intervene.

Q: When should organisations prioritise runtime mediation over post-action review for AI agents?

A: As soon as an agent can touch production systems, external APIs, money movement, or sensitive data. Post-action review can explain what happened, but it cannot stop an irreversible action once the model has already executed it. Runtime mediation is the control that prevents impact, not just records it.

Q: What are the warning signs that an AI agent is overprivileged?

A: Warning signs include an agent that can reach tools or data stores unrelated to its task, persists with the same privileges after the session ends, or depends on static credentials instead of short-lived tokens. If the agent’s access can be reused across tasks, or if its actions cannot be clearly attributed to a bounded workload identity, overprivilege is already present.

Q: How should security teams balance human approval with autonomous agent actions?

A: High-risk actions should require explicit step-up approval, while low-risk reads can remain automated under tight scope. The goal is not to block all automation, but to reserve human judgment for destructive operations, bulk exports, and privilege changes. If approval never appears in the path, then the trust model is too broad for the action being taken.

Technical breakdown

Why complete mediation matters for agentic AI

Complete mediation means every meaningful action passes through an independent policy decision point before execution. In agentic systems, that gate cannot live inside the model because the model is the thing being trusted to act. The control has to sit between the agent and the downstream system, where policy can inspect context, destination, risk, and reversibility. This is how teams separate reasoning from authorization. Without that separation, a model that is misled, over-prompted, or over-privileged can still complete the action even when the decision was wrong. See the AI Agent Authorisation Guide.

Practical implication: Put a deterministic approval gate in front of every tool action that can change state, move data, or spend money.

Why excessive autonomy becomes an identity problem

Excessive agency is not only about model behaviour. It is also an identity problem because the agent only becomes dangerous when it is granted authority that is broader than the task. That can include standing credentials, broad tool scopes, or reusable sessions that outlive the moment they were needed. The article's framing is important: permission is only as safe as the identity it is attached to. When an AI system can act under a privileged identity, the security issue is no longer prompt quality but delegated authority without tight scoping, traceability, and revocation. See the Privileged Access Management Guide.

Practical implication: Treat agent identities like privileged identities and scope them to the smallest possible task window.

How live-path controls change the security model

Traditional controls often assume humans make requests, review them, and then execute them later. Agentic systems compress those steps into a single runtime loop, so the control has to operate in the live path rather than after the fact. That is why graduated enforcement matters: some actions can auto-approve when reversible, while others need escalation or human confirmation. The important architectural point is that the gate must be independent of the model and deterministic in its decisioning. If the model can influence the gate, the gate is no longer a gate. See the Agentic AI Security Guide.

Practical implication: Design runtime policy for reversible versus irreversible actions instead of relying on post-action review.

Threat narrative

Attacker objective: The attacker wants to turn the agent's delegated authority into an action that the victim system accepts as legitimate.

1. Entry begins when untrusted content, poisoned instructions, or over-broad task input reaches an agent that can read and act on it in the same session.
2. Credential access or privilege use follows when the agent inherits tools, data access, or external channels that let it perform actions the operator did not explicitly review in real time.
3. Escalation occurs when the agent combines trusted context with delegated permissions and completes a high-impact action such as data release, payment, or infrastructure change.
4. Impact appears as irreversible downstream change, because the system treated the agent's decision as authoritative instead of forcing a separate approval step.

Breaches seen in the wild

• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Excessive Agency is really a delegated-authority problem, not a prompt-engineering problem. The article is right to shift attention from model quality to the decision point that governs action. Once the agent can move money, expose data, or call external tools, the security question becomes who or what is allowed to decide. That is the same governance problem IAM has always handled, just at machine speed and with far less human friction. Practitioners should treat agent autonomy as a privilege model first and an AI problem second.

Complete mediation is the right control pattern for agentic systems because post-hoc review arrives too late. A model that can act before a human sees the request will outrun any review process that depends on after-the-fact certification. The article's emphasis on deterministic mediation is the correct architectural answer: decisions belong outside the model, with policy able to block, escalate, or allow based on the action itself. That makes the issue measurable and governable. Teams should redesign approval logic around action boundaries, not conversational turns.

Least agency should become the default security design principle for agentic AI. The safest agent is not the one that can do everything, but the one that can do only what the current task requires. Broad permissions, long-lived sessions, and reusable tool access create the same blast-radius problem that over-privileged service accounts create in conventional IAM. The difference is that the agent can execute the misuse itself without waiting for a human. The practical conclusion is to scope, constrain, and revoke by task, not by convenience.

Agent identity governance now sits at the intersection of NHI and AI security. The article makes that intersection explicit when it links Excessive Agency to the identity layer that grants permission. That means controls for AI infrastructure workload identity and machine privilege are no longer peripheral to AI governance, they are part of it. If the identity behind the agent is loose, the model's reasoning quality cannot compensate. Practitioners should govern the agent's identity lifecycle, not just its prompts and outputs.

Operational security for agentic AI will increasingly look like policy enforcement, not model supervision. The list's mitigation pattern points toward runtime gates, reversible-action handling, and explicit escalation ladders. That is a governance model that can be audited, tested, and monitored, unlike vague assurances about safe model behaviour. The field is moving toward systems where the important question is whether the gate fired correctly. Security teams should measure that control, not the model's confidence.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Authorisation Guide

What this signals

Least agency is becoming the practical control model for agentic AI. Teams should expect policy gates, scoped permissions, and reversible-action handling to replace broad trust in model behaviour. The bigger the agent's operating surface, the more control has to move into the live path rather than the review queue.

Identity is now the enforcement layer for AI action. As agentic systems take on more work, the permissions attached to their identities will matter more than the wording of their prompts. That makes workload identity, delegated authority, and revocation the governance variables that security teams need to track closely.

Policy gates will become the new evidence point for AI governance. When the model can be fooled, the differentiator is whether the downstream control stopped the action. Security leaders should prepare to measure agent safety by the number of blocked or escalated actions, not by model accuracy alone.

For practitioners

• Implement deterministic approval gates for high-impact actions Require every agent action that can move data, spend money, change permissions, or alter infrastructure to pass a policy decision point before execution.
• Reduce agent privilege to task scope only Issue the minimum tool access and data access needed for the current job, then revoke it when the task completes or the session ends.
• Separate reversible actions from irreversible actions Auto-approve only actions that can be cleanly undone, and route irreversible actions to human escalation or stricter policy checks.
• Audit agent identity and tool sprawl together Inventory which identities can invoke which tools, then flag any agent that combines broad permissions, multiple tools, and outbound channels in one path.

Key takeaways

• The article frames excessive agency as the point where an AI system can turn delegated authority into an actual downstream action.
• The strongest evidence in the piece is the shift from vote-based ranking to 7,714 real incidents, which pushes the debate toward operational control.
• Deterministic mediation and least agency are the controls most likely to reduce blast radius when an agent can act on its own.

Related NHI Mgmt Group resources: Agentic AI Security Guide · AI Infrastructure Workload Identity Guide · AI Agent Authorisation Guide · Moltbook AI agent keys breach

Key terms

• Excessive agency: A condition where an AI system is given more operational authority than its task requires. The risk is not just poor output. It is that mistakes, manipulation, or compromise can produce destructive actions at machine speed across the systems the agent can reach.
• Complete Mediation: Complete mediation is the principle that every access to a sensitive resource must be checked against policy. In key management, it means no signature can be produced unless the request passes the same control path each time. This prevents bypasses and makes enforcement consistent across users, applications, and workflows.
• Least Agency: The agentic equivalent of least privilege, the principle that AI agents should be granted only the minimum level of autonomy necessary to complete their designated task, and no more. Coined in the OWASP Top 10 for Agentic Applications 2026.
• Runtime Policy Gate: A deterministic control that evaluates an AI agent's action at the moment it is about to execute. It is used to decide whether to allow, block, warn, or escalate based on policy, especially when the action could cause irreversible or high-impact change.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It is designed for practitioners who need to turn identity controls into operational guardrails across modern environments.