When an agent’s tools can do more than the task needs, any model mistake or injected instruction becomes a damaging action with real permissions.
- Give each tool the minimum functionality and permissions, scoped to the user it acts for.
- Authorize every tool call outside the model, against the user’s own permissions.
- Require explicit approval for irreversible or high-impact actions, and limit autonomous loops.
Guides on this site
Authorize agent tools outside the model
Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.
Contain prompt injection at the application boundary
Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
Constrain MCP and multi-agent trust boundaries
Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.
Practice
References
- LLM06:2025 Excessive Agency (OWASP, 2025 edition)
- OWASP Top 10 for LLM Applications 2026 (OWASP GenAI Security Project resource page)
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.