Versatile AI Risk Assessment

AI threat catalogue Agentic and Autonomous AI Production

Excessive Agency

An AI system is granted more permissions or freedom to act than its task requires. Faulty or manipulated outputs then directly trigger consequential actions such as payments, data deletion, or system changes.

As of: October 2026 · Catalogue version 2026.10.24.2 · 5 mitigations · 7 verified sources

Description

Many AI assistants are connected to other systems through interfaces and can act there on their own, for example sending emails, changing records, or placing orders. The threat arises when the system is given more functions than it needs, operates with overly broad permissions, or may carry out consequential steps without human confirmation. Language models do not reliably separate instructions from the content they process. A prompt injection (hidden instructions embedded in processed content), an ambiguous request, or a plain model error can therefore trigger a damaging action. The system then technically acts within its granted permissions, so conventional access controls do not stop the damage.

Possible impact

Possible consequences include unwanted financial transactions, deleted or altered data, and interference with production systems, depending on what the AI system is connected to. If personal or confidential data leaks in the process, data protection violations and notification obligations follow. The EU AI Act requires effective human oversight for high-risk systems, including the ability to override outputs and to stop the system.

Example

An AI assistant is meant only to summarize incoming emails but also has permission to send email. A crafted message containing hidden instructions makes it forward confidential messages from the mailbox to an external address. The incident is noticed only after the data has already left the company.

Recommended mitigations (5)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Least privilege for agent actions

    Technical
    Effect
    Preventive, Impact-limiting
    Implementation level
    Application, API & agents
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by binding workflows.

  • Human-in-the-loop approval for critical actions

    Organizational & process-based
    Effect
    Preventive
    Implementation level
    Application, API & agents, Use & operations
    Classification and rationale

    Complementary control typePeople & competence

    Primarily organizational and process-based: A binding workflow requires an accountable human decision before use or execution; complemented by human expertise and judgment.

  • Action audit logging

    Technical
    Effect
    Detective
    Implementation level
    Application, API & agents, Use & operations
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.

  • Rate limits on agent operations

    Technical
    Effect
    Preventive, Impact-limiting
    Implementation level
    Application, API & agents
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures; complemented by binding workflows.

  • Reversibility and rollback capabilities

    Technical
    Effect
    Impact-limiting, Restorative
    Implementation level
    Application, API & agents, Use & operations
    Classification and rationale

    Primarily technical: Versioned states or rollback mechanisms enable controlled recovery.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 LLM03:2026NIST AI RMF Section 3.5MITRE ATLAS AML.T0048EU AI Act Article 14(4)(d) · Article 9(1), 9(2)(a), 9(2)(d)BSI R28 · R3

Verified references (7)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Build in effective human oversight Art. 14 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

  • Prompt Injection Manipulated input or planted content redirects a language model.
  • Least privilege Gives people, services and agents only the permissions their task requires.

More entries from the topic group Agentic and Autonomous AI.

Misalignment The AI system does not pursue the goals its operator or users intend but whatever it was actually optimized for. Agentic AI / Autonomous Agents AI agents plan multi-step tasks on their own and carry them out with tools such as email, databases, or code execution. Agent Memory Poisoning (Persistent Context) AI agents with persistent memory carry information from earlier sessions forward as trusted context for future decisions.

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

Particularly important for:

  • AI agentThe agent has write access across several business applications despite needing only read access. An error or injected instruction then changes records or triggers payments.
  • Automated content moderationThe system can suspend accounts without human review. An error then affects many people at once before anyone notices.
  • Payment fraud detectionThe system can reject payments without human review. A wrongly configured threshold can stop many legitimate payments in a short time.
  • Algorithmic managementThe system can withdraw shifts or suspend accounts when measurements fall below a threshold. A measurement error, such as an incorrect location, can then cost someone their income without a review.
  • Sales and demand forecastingIf the system orders without approval, a forecasting error affects many stores at once. Fresh food then spoils in storage, or shelves remain empty.
  • Autonomous mobile robots in intralogisticsRobots and people share spaces. If control permits more than the safety concept allows, such as higher speeds or entry into restricted zones, collisions may result.
  • Coding agentPermission to write to the main branch, production access credentials or cloud accounts lets mistakes cause damage beyond development. An unreviewed merge can send a change straight into production.

Typical for:

For 33 further use cases, relevance depends on the system design, for example whether it changes data or triggers processes or calls other programs or interfaces. Show these use cases

Frequently asked questions

What is Excessive Agency?
An AI system is granted more permissions or freedom to act than its task requires. Faulty or manipulated outputs then directly trigger consequential actions such as payments, data deletion, or system changes.
Which mitigations help against Excessive Agency?
The catalogue lists 5 mitigations, each with control type, effect and implementation level. First among them are Least privilege for agent actions, Human-in-the-loop approval for critical actions and Action audit logging.
Which EU AI Act obligations does Excessive Agency touch?
The catalogue maps this threat to Art. 9 and Art. 14 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system and Build in effective human oversight. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Excessive Agency”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/excessive-agency/

← Back to the full catalogue