Excessive agency: over-powered tool-using agent, no scoping/human-in-loop
Part of the AI app safety check · fix arrives as a guide
What it is
A tool-using agent is wired to capabilities broader than its task needs — write access, network egress, shell, or money-moving APIs — with no scoping and no human confirmation step before it acts.
Why it matters
Every prompt-injection weakness in the app inherits the agent's permissions. The impact of a successful injection stops being "wrong answer" and starts being "sent the email, dropped the table, issued the refund".
How to fix it
Scope each tool to the narrowest capability that works, and separate read tools from write tools. Put a human confirmation in front of anything irreversible or outbound. Give the agent its own credentials so its blast radius is bounded and auditable.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.