Excessive Agency

The failure is not that the model turns hostile; it follows instructions literally while holding more power than the task requires. A hallucination or a prompt injection then turns that power into a wrong action.

You do not fix Excessive Agency with a smarter model or a better prompt. You fix it structurally: minimize the tools an agent can call, scope its permissions to the task, and require human approval for high-impact actions.

A concrete example: an agent granted broad CRM write and send access "just in case" reads a misleading instruction and overwrites or deletes records, or emails the wrong customer. The scope, not the intent, is the vulnerability. Least privilege plus a human approval gate on irreversible actions removes the blast radius while leaving the agent useful for everything reversible.