Secure AI Atlas mark Secure AI Atlas SECURITY & GOVERNANCE
EN / ES

Risk

Excessive Agency

An AI system can take actions that exceed its reliability, authorization, or oversight model.

agentsauthorizationhuman approval
Domain
Agent
Mechanism
Authorization
Overreliance
Boundary
Between model decision and executed action
Trigger
The agent is granted authority exceeding its reliability or supervision
Consequence
Actions executed beyond authorization or oversight
Required evidence
  • Approval and authorization logs
  • Least-privilege configuration
  • Oversight and escalation policy

Exposure

Excessive Agency appears when an AI system can do more than the organization can safely observe, constrain, or reverse. Examples include sending messages, modifying records, purchasing services, deploying code, changing access, or escalating workflow decisions.

The risk is not autonomy by itself. The risk is autonomy granted before the system has bounded permissions, clear owners, approval gates, and evidence trails.

Signals

  • The AI system can execute actions without separating recommendation from execution.
  • Service accounts have broad permissions because least privilege was inconvenient.
  • Human review exists only after the action has already happened.
  • The rollback path is unclear or manual.

Failure pattern

Capability is mistaken for authority. The model may misunderstand context, follow hostile instructions, optimize the wrong objective, or produce a plausible plan that exceeds its mandate.

Shadow Decision

A specific failure of supervision within Excessive Agency: the human reviewer approves because the system appears competent, not because the evidence supports the decision. Authority is surrendered to capability when the reviewer lacks time, evidence, or leverage to scrutinise the proposal. This is not a technical bypass — it is a governance failure where the control exists on paper but the human stops exercising it.

Mitigation requires an Evidence Channel that separates the reviewer’s decision interface from the interaction channel, giving the reviewer sources, references, and reasoning alongside the proposed action. Without evidence, approval is theatre.

  • Start with read-only access where possible.
  • Separate recommendation from execution.
  • Require Human-in-the-Loop approval for high-impact actions.
  • Use scoped service accounts and explicit action limits.
  • Define rollback, notification, and post-action review requirements.

Provenance

MAPPED
Not recorded
ANALYZED
Not recorded
UNRESOLVED
Not recorded

Last reviewed: Sep 20, 2026