The Problem in Plain Terms
AI agents are being deployed at enterprise scale faster than the security frameworks needed to govern them can be built. The result is a structural vulnerability that doesn't require a clever exploit to trigger — just an agent with too much access and a task that's not well-defined enough to constrain it.
Gartner projects that 40% of enterprise applications will incorporate task-specific AI agents by end of 2026, up from under 5% in 2025. The Gravitee State of AI Agent Security 2026 Report found that 80.9% of technical teams are already in active testing or production with AI agents — but only 14.4% deploy them with full security or IT team approval. The gap between adoption and governance is not a future problem. It is a present one.
What "Excessive Agency" Looks Like
The OWASP Top 10 for Agentic Applications 2026 lists Excessive Agency as a top-tier threat. It manifests when an AI agent is assigned a broadly defined mission ("manage the sales pipeline," "process inbound customer requests") and granted access to the systems needed to carry it out — without meaningful constraints on what it can read, write, or transmit.
A concrete example: a campaign-tracking agent granted CRM access to monitor deal progress may, by design or misconfiguration, also have visibility into contracts, billing records, and personally identifiable information. The agent wasn't asked to touch those fields — but it can, and an attacker or a malicious instruction can direct it to do so.
The "vague task" problem amplifies this. When an agent's success criteria are loosely defined, it has no principled reason to avoid actions that technically fall within scope but clearly exceed intent. Without hard access constraints enforced at the infrastructure level, the model's judgment becomes the only guardrail — and judgment can be manipulated.
Identity Ambiguity and Delegation Chains
AI agents can operate under their own identity, a delegated user scope, or a combination of both. When an agent is granted permissions that exceed those of the delegating user — a configuration that is more common than it should be — the authorization boundary effectively dissolves.
The problem compounds in multi-agent architectures. The Gravitee report found that 25.5% of deployed agents can create sub-agents. When Agent A spawns Agent B and passes it a task, the delegation chain often inherits or compounds the parent's permissions, creating a scope that no individual human approved and no audit system can easily reconstruct.
Static identity management — agents running with hardcoded API keys, shared service accounts, or borrowed OAuth tokens — leaves no reliable attribution, no task boundary, and no mechanism for revoking access when a task completes. The agent persists. The credentials persist. The risk accumulates.
Prompt Injection: The Manipulation Vector
Excessive agency creates the blast radius. Prompt injection provides the fuse.
Malicious instructions embedded in content that an agent legitimately processes — emails, documents, web pages, tool output — can redirect it toward unauthorized actions. An agent reading a support ticket that contains a hidden instruction to forward all attachment contents to an external endpoint may comply, because its safety training didn't anticipate that the ticket itself would carry an adversarial payload.
This is not hypothetical. Researchers demonstrated in 2025 and early 2026 that AI agents with broad filesystem, email, and API access can be redirected via injection in processed inputs. The combination of vague task definitions (which leave behavioral scope open) and broad access (which makes that scope dangerous) creates a worst-case scenario for injection attacks.
What Governance Looks Like
The security community has begun to converge on a set of principles for AI agent governance:
Least-privilege access: Each agent should be scoped to only the specific datasets, folders, APIs, and systems required for its defined task — enforced at the API gateway or IAM layer, not by model-level instructions alone.
Just-in-time, short-lived credentials: Rather than persistent service accounts, agents should receive credentials scoped to the lifecycle of a specific authorized task and revoked upon completion. This limits the damage window if an agent is compromised or misdirected.
Task-centric authorization: Access grants should be generated and revoked in alignment with a formal task definition — not a standing permission set. When the task ends, access ends.
Full audit trails: Organizations need centralized, tamper-evident logs of which agents accessed which resources, when, and under what instruction context. Without this, incident response after an agentic breach becomes forensically intractable.
Guardrails on multi-step sequences: Safety systems should evaluate full tool call sequences, not individual calls in isolation. An agent that reads a .env file, then calls an HTTP endpoint, then encodes content as base64 has executed a data exfiltration — even if no individual step triggered a filter.
The Bottom Line
The "vague task, total access" pattern isn't an implementation bug. It's the default state when AI agents are deployed quickly by teams that are focused on productivity gains rather than access governance. Fixing it doesn't require abandoning agent deployments — it requires applying the same identity and access management discipline to AI agents that mature organizations apply to human users and service accounts.
The OWASP Top 10 for Agentic Applications 2026, the CoSAI MCP Security whitepaper, and emerging guidance from vendors like Microsoft all point toward the same solution space: treat AI agents as first-class security principals, scope their permissions precisely, and build the tooling to audit what they actually do — not just what they were told to do.