How do you stop an AI agent from taking actions it shouldn't?
Limit three things, as OWASP's guidance on excessive agency recommends: the tools an agent has, what each tool is permitted to do, and how much it may do without a person. Give it only the functions the task needs, run them with the requesting user's own permissions, enforce authorisation in the systems being called rather than in the prompt, and require human approval for high-impact actions such as payments, deletions or messages sent on someone's behalf.
- Published
- 22 October 2026
- Sources checked
- 22 October 2026
- From
- Kramiva
01
Where the risk comes from
OWASP lists Excessive Agency as LLM06 in its 2025 Top 10 for LLM applications, with three root causes: excessive functionality (tools the agent does not need), excessive permissions (tools that can do more than intended), and excessive autonomy (high-impact actions with no check). A model can be manipulated by text it reads — an email, a web page, a document — so whatever it can do, an attacker who controls that text may be able to make it do.
02
Controls that work
Adapted from OWASP's mitigations.
- Give the agent only the tools the task needs
- Make each tool narrow: “read this mailbox” rather than “run any command”
- Avoid open-ended tools such as a general shell or URL fetcher where a specific one will do
- Run tools with the requesting user's credentials and the minimum privileges
- Check authorisation in the downstream system, every time, not in the prompt
- Require a person to approve high-impact actions before they execute
03
An illustrative example
An assistant that summarises a shared inbox needs read access to that inbox — not permission to send, delete or forward. If it should draft replies, it can save drafts for a person to send. That one design choice removes the risk of a malicious email instructing the assistant to forward the inbox elsewhere.
04
Trade-offs
Every approval step slows the process and can turn into a reflexive click if it fires too often. The aim is to put approvals only where an action is costly or irreversible. OpenAI's guide makes the same split, naming cancelling orders, large refunds and payments as actions that should involve a person. The MCP specification likewise requires hosts to obtain user consent before invoking tools.
Where Kramiva fits
Kramiva's AI automation service makes this structural: sending, paying, deleting and publishing require a person's approval by design, and every decision is logged with who approved it.
Sources
- LLM06:2025 Excessive Agency — OWASP GenAI Security Project
- A practical guide to building agents — OpenAI
- Model Context Protocol specification — Model Context Protocol
Accessed 22 October 2026. Kramiva is not affiliated with these publishers.
Related questions
Tell us what you are building.
A short brief gets you a real reply from a founder within one business day — an honest read on fit, scope, and budget.