SHRIKEExcessive agency
Excessive agency is the risk condition where an AI system holds more capability, permission, or autonomy than its task requires, so a failure or subversion does maximum damage. It is the agent-era form of over-privilege: the gap between what an agent can do and what it should do.
Catalogued in the OWASP LLM Top 10, excessive agency is rarely designed in deliberately. It accumulates: a broad API token saved for later, a tool added for one task and never removed, autonomy widened because approvals felt slow. The remedy is making intended agency explicit, a declared scope per agent, so "outside the declaration" becomes a detectable, governable event instead of a shrug.
Related
Shrike governs AI agent actions in real time: every command, query, and tool call evaluated against policy before it executes. Start with what is action governance or the quickstart.