How much control are you giving your AI agent?

This is the first of the seven questions in the OWASP Top 10 for Agentic Applications, and arguably the one teams skip past fastest. It's tempting to let an agent decide as much as possible - that's often the point of building it.

But OWASP frames autonomy as something that should be earned deliberately through testing and monitoring, not granted by default because it's technically possible. The principle is sometimes called "least agency": only give an agent as much independent decision-making as the task actually requires.

Autonomy isn't the only variable, though. An agent that can be influenced is an agent that can be redirected by someone else with other intentions. Prompts, retrieved documents and the tools it connects to, are all potential entry points for manipulation.

OWASP categorises this as prompt injection and tool misuse. A poisoned data source or a compromised plugin doesn't need to break the agent's code to cause harm; it just needs to change what the agent believes is true.

Finally, there's the question of access. An agent's permissions and identity controls define how much damage it can cause if something does go wrong. OWASP flags privilege abuse, such as agents inheriting or accumulating more access than they need, as one of the top risks in agentic systems. And for good reason: an agent with narrow, well-defined access can only cause narrow, well-defined damage.

Three questions to answer before you grant more autonomy:

• How much can this agent decide on its own, and does the task actually require that?
• How could this agent be manipulated – through prompts, data, or tools?
• What's the maximum damage this agent could do with its current permissions?

In the next post, we'll look at what happens once an agent is running: what it should remember, when a human needs to step back in, and how to know it's ready for production.

Our course Building safe AI agents walks your developers and product owners through all of this in practice.

‍