ShrikeExcessive agency
Excessive agency is the risk condition where an AI system holds more capability, permission, or autonomy than its task requires, so a failure or subversion does maximum damage. It is the agent-era form of over-privilege: the gap between what an agent can do and what it should do.
Catalogued in the OWASP LLM Top 10, excessive agency is rarely designed in deliberately. It accumulates: a broad API token saved for later, a tool added for one task and never removed, autonomy widened because approvals felt slow. The remedy is making intended agency explicit, a declared scope per agent, so "outside the declaration" becomes a detectable, governable event instead of a shrug.
Related
Shrike governs AI agent actions in real time: every command, query, and tool call evaluated against policy before it executes. Watch an agent get refused in the playground, where every tool call is scanned for real, or read what is action governance.