Smarter agents. Smaller permissions.

Make the model a planner, not the authority

A planning assistant can suggest the next review question. An execution component determines whether an approved action may run. Keep those roles separate. The model's confidence, a retrieved document, or a familiar target name must not create permission.

OWASP's excessive-agency guidance identifies risks from too much functionality, permission, or autonomy. Use those distinctions to review the surrounding software, not just the wording of the prompt.

Represent the scope in policy

Define exact service identifiers, allowed operations, test identities, request budgets, expiration, and excluded destinations. Have the runner validate every proposed operation against that policy. A redirect or a newly discovered route should not silently expand an assessment.

Keep tool contracts narrow

Prefer retrieving a sanitized finding by identifier to reading arbitrary files. Prefer launching an approved profile to accepting a general shell command. Return explicit operational status and evidence references. Keep raw secrets away from model-visible parameters when a restricted credential reference will do.

Put approval at consequential boundaries

Require a review before changing scope, increasing traffic, performing state-changing operations, or distributing sensitive reports. Describe the operation, its target, likely side effects, budget, and stop procedure. Bind the approval to the actual configuration and let it expire when assumptions change.

An approval to draft a ticket is not approval to publish it. A read-only report summary is not approval to run a network assessment. Make those differences visible in both the interface and the execution policy.

Design for mistakes and interruptions

Bound runtime, concurrency, and retries in the runner. Provide an operator-controlled stop that does not depend on the model agreeing. Preserve a partial record when a job is cancelled. An interrupted assessment must not be summarized as complete.

Evaluate untrusted instructions inside tool output, expired scope, malformed results, and conflicting observations. Inspect what the system actually did, not only what the assistant said. Keep identifiers connecting proposal, approval, execution, and summary.

Start with the smallest useful agent

Use the prompt library for a text-only design review. Then read the agentic AI field guide for a staged approach. Expand capability only when a specific benefit and a tested control justify it.

Primary references

Read the documentation that matches your tool, framework, and deployment. These sources provide context; they do not establish coverage of your environment.

• OWASP LLM06:2025 — Excessive Agency