The problem
The OWASP LLM Top 10 names Excessive Agency (LLM06 in the 2025 edition, LLM08 in 2023) as a top risk: an agent granted broad permissions, autonomy, or functionality can be steered, by a bug or an attacker, into actions far beyond its task. MITRE ATLAS catalogues the techniques that get it there, from prompt injection to tool coercion.
Core idea: the blast radius of a compromised agent is exactly the authority you gave it. Shrink the authority, shrink the damage.
Least-privilege authority
Borrowing from decades of access-control practice, each agent should hold the minimum capability its task requires: scoped, attested, and revocable:
- Scoped. Authority is bound to specific tools and resources (e.g.
finance.read, notfinance.*). - Attested. The grant is tied to a verified identity, not a shared secret.
- Revocable. Authority can be withdrawn instantly, without redeploying the agent.
A verdict per call
Static permissions aren't enough, because context matters. Every tool call should be evaluated at the moment it happens, against the agent's scope, rate limits, and the current request, and allowed, blocked, or escalated for approval.
Proof
Finally, each decision should be recorded as verifiable evidence, so you can show exactly what each agent was allowed to do and why. That is the accountability the NIST AI RMF expects of any deployed AI system.
Next: see Agent Security for capability-scoped authority in practice.