Excessive agency is the risk created when an AI system holds more capability, permission or autonomy than its task requires — allowing a hallucination, manipulation or ordinary error to produce consequential and often irreversible action.
What is excessive agency in AI?
Excessive agency has three distinct causes, each with a different remedy: excessive functionality, where an agent can invoke tools it never needs; excessive permission, where it operates under credentials broader than its task; and excessive autonomy, where it acts without approval on decisions that warrant a human. It is the risk that converts a model failure into a business incident, because the model's mistake is executed rather than merely displayed. The controls are unglamorous and effective — least-privilege tooling, agent-specific identity, and approval gates on irreversible actions.