Excessive agency happens when an AI agent is allowed to do more than the use case requires. It may have too many tools, broad permissions, weak approval gates, or the ability to take actions that are difficult to reverse. The agent may work well in normal tests and still create unacceptable risk when it receives unexpected input.
The fix is to design agency deliberately. Agents should receive the minimum authority needed to complete the approved task.
Start with the job to be done
Define the agent's purpose in operational terms. What workflow does it support? What actions are necessary? What actions are out of scope? Which user group can use it? What data does it need? What should it never do?
A vague goal such as help the support team invites broad tools. A precise goal such as draft a suggested response using approved help-center articles creates a safer boundary.
Apply least privilege to tools
Each tool should be reviewed separately. Read-only access is different from write access. Drafting a message is different from sending it. Creating a ticket is different from closing one. Querying an account is different from changing billing information.
Give the agent narrow tools with scoped permissions rather than broad tools with instructions to behave. Policy in the prompt is not a substitute for permission design.
Add approval gates for sensitive actions
Some actions should require human approval: external messages, financial changes, access changes, account updates, legal communications, security-sensitive operations, or actions affecting regulated records. The approval should happen before the action, with enough context for the reviewer.
Limit loops and fallback behavior
Agents can create risk when they keep trying after failure. Set limits on retries, tool calls, transaction size, execution time, and escalation behavior. When the agent is uncertain, it should stop, ask for review, or move to a safer path.
Monitor real behavior
Review tool-call logs, blocked actions, human overrides, unexpected tool combinations, and incidents. Excessive agency may not be obvious during design review. It often appears when users find creative ways to apply the agent.
A safe agent is not one that promises to follow instructions. It is one whose authority, tools, and failure modes are constrained by design.