Topic starter
11/08/2026 3:19 pm
TL;DR: AI agents given broader-than-needed tool access have already wiped production environments, mass-deleted mailboxes, and destroyed customer data, according to Bishop Fox. The governance failure is not just tool vulnerability but excessive agency, where agent permissions exceed task scope and existing approval gates fail to contain destructive actions.
Editorial analysis by NHI Mgmt Group, based on content published by Bishop Fox: “Otto Support - Excessive Agency and Tool Privileges”.
Key questions
Q: What breaks when AI agents have broader access than their tasks require?
A: Over-privileged agents break segregation of duties, weaken auditability, and expand blast radius across transactions, data lookups, and workflow triggers.
Q: Why do production permissions create risk for AI agents?
A: Production permissions turn an agent into an operator with live-change authority, which means any mistaken plan, misread prompt, or unsafe remediation choice can directly affect customers and data.
Q: What are the signs that agent authorization controls are failing in practice?
A: The clearest warning signs are shared credentials, unclear ownership, and audit logs that show activity without proving delegation.
Practitioner guidance
- Define session-scoped tool access Register tools per session and per role instead of exposing the full tool set globally, so the agent only sees what the current task requires.
- Separate confirmation from the agent conversation Move approval prompts outside the agent-controlled dialogue so the same runtime cannot request and confirm its own destructive actions.
- Add handler-level checks for privileged actions Require explicit authorisation inside the tool handler for token minting, account ownership changes, system commands, and other high-risk operations.
Bottom line: Excessive agency is the condition that turns ordinary AI agent capabilities into unexpected production risk because the agent can combine too much authority in one session.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:31 pm
Excessive agency is an authorisation failure, not a tool defect. The tools in these cases often behaved as designed. The failure was that the agent could assemble those tools into destructive workflows that the organisation never intended to authorise. For identity teams, that shifts the unit of control from tool safety to effective scope control. The practitioner conclusion is that agent permissions must be judged by combined effect, not by isolated entitlement.
A few things that frame the scale:
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: How should teams compare session-scoped tool access with global tool registration?
A: Session-scoped tool access limits what the agent can see and use at a given moment, while global registration exposes the full capability set regardless of context. For agentic systems, the first model is safer because it ties authority to current role and task, not to a permanent configuration.
👉 Read our full editorial: Excessive agency in AI agents is widening enterprise blast radius