Excessive Agency & Privilege Escalation in Autonomous Agents (OWASP LLM08)

1. What is Excessive Agency?

Excessive Agency occurs when an autonomous agent is granted permissions, tools, or network access that exceed what is strictly necessary to perform its intended task:

• An assistant meant to summarize Slack channels is given a bot token with admin:write privileges.
• A GitHub coding agent is given write access to main branch instead of creating isolated branch PRs.
• An analytics agent is given direct write/delete permissions on the production PostgreSQL database.

When combined with indirect prompt injection, excessive agency turns a simple reading agent into an attack proxy capable of dropping databases or stealing proprietary source code.

2. The Principle of Least Privilege in Agent Systems

   Bad Architecture (Excessive Agency):
   Agent ──► [ Super-Admin Service Token ] ──► Unlimited read/write access to all repos & DBs

   Good Architecture (Least Agency):
   Agent ──► [ Ephemeral Scoped Token ]
                │
                ├── Read: Current Repo Only
                ├── Write: Branch `agent-patch-123` Only
                └── Blocked: Delete Branch, Push to Main, Secrets Read

3. Hardened Tool Authorization Controls

1. Scoped Capabilities: Separate read tools (get_user_profile) from state-modifying tools (update_user_email).
2. Step-Up Authentication (MFA): Require out-of-band user approval for critical actions.
3. Session Context Propagation: Tool execution runs under the requesting user's identity, never under an all-powerful system service account.