
Agentic product designBy Lindsey J
Your AI agent's permissions are bigger than its job
OWASP names the AI agent risk that isn't prompt injection: excessive agency, when a tool has more functionality, permission, or autonomy than its task needs. A checklist and a decision rule to scope it before an incident does.
4 min read









