Excessive Agency in Agentic AI: Setting Safe Boundaries Project | Quiz

WHY: The agent chains multiple legitimate capabilities together for malicious purposes becoming both the vulnerability scanner and the attack vector in one autonomous sequence. CONTEXT: Broad tool access allows capability chaining where each tool is legitimate individually but devastating in combination. REMEMBER: Chained capabilities equals the agent becomes scanner exploiter and exfiltrator.

WHY: Level 5 is self-modifying or privilege escalation where an agent can grant itself additional permissions or modify its own capabilities. CONTEXT: This is the most dangerous level because the agent can expand its own power without authorization potentially gaining access far beyond intended scope. REMEMBER: Level 5 equals NEVER permitted.

WHY: Excessive agency manifests across three distinct dimensions: excessive functionality (too many tools) excessive permissions (too much access) and excessive autonomy (too little oversight). CONTEXT: Understanding these dimensions helps identify exactly where your agents have too much power and where to apply controls. REMEMBER: Three dimensions equals functionality permissions autonomy.

WHY: New agents should start highly restricted because it is far easier to grant additional permissions than to recover from excessive agency incidents. CONTEXT: As agents demonstrate reliability over time they can earn expanded permissions with full audit trail. Any misuse should trigger automatic permission downgrade. REMEMBER: Start restrictive expand carefully.

WHY: This is Persistent Behavioral Drift where an agent behavior gradually changes over time without explicit authorization. CONTEXT: The danger is incremental: not a sudden change but slow expansion that goes unmonitored. Eventually high-risk operations are executed autonomously. REMEMBER: Gradual boundary expansion equals behavioral drift.

WHY: OWASP states Treat agent requests like requests from the internet because agents might be compromised misinterpret instructions or pursue goals through unexpected means. CONTEXT: This means never assume agent behavior is safe verify every action independently and enforce security at system boundaries not in agent logic. REMEMBER: The agent is not on your team do not trust verify.

WHY: The article states as mandatory policy that all agent access to production systems should be read-only unless an explicit justified exception is granted. CONTEXT: Write delete or modify privileges require documented business need and additional safeguards. This limits the ceiling of potential damage. REMEMBER: Read-only by default for production.

WHY: Agents can be manipulated through prompt injection can misinterpret well-crafted prompts and can find unexpected paths to goals. CONTEXT: Prompt engineering safety training and good intentions are not security controls. Real security comes from external constraints like permissions monitoring and approval workflows. REMEMBER: You cannot prompt-engineer your way to security.