Agents, tools and excessive agency

From words to actions

An agent is a model in a loop: it reads a task, calls tools (send email, run a command, cancel a meeting), reads the results and decides what to do next. It acts with its user's authority, and it reads untrusted content as part of the job.

Combine the two and an injection becomes an action: the user asked for a summary, and the agent sent an email, cancelled a meeting or recommended a payment.

Excessive agency

OWASP calls it excessive agency: more functionality, permission or autonomy than the task needs. A tool held "just in case" is a tool an attacker can reach for.

What holds

Give each task only the tools it needs, scoped to the user's own permissions. Make consequential actions wait for a confirmation the system draws, not text the model writes. Limit steps, spend and loops. Log every tool call with the input that led to it.