Before any AI agent gets access to your business — your email, your files, your customer records, your ability to send money — there are really only two questions that matter: what can it access, and what can it do without asking you first? If you can’t answer both clearly, you don’t yet have enough control over that agent to deploy it safely.
This isn’t a hypothetical concern. Agentic AI risks jumped in priority industry-wide in 2026 for a specific, documented reason, not just growing hype.
Why AI Agent Security Risks Jumped to #3 on OWASP’s List
In our breakdown of the OWASP LLM Top 10, we covered how “Excessive Agency” — AI systems being granted more real-world capability than a task actually requires — climbed from 6th place to 3rd in OWASP’s 2026 rewrite, the single biggest promotion on the entire list. That ranking wasn’t a community vote; it was based on an analysis of over 7,700 real-world incidents.
The 3 Dimensions of “Excessive Agency” (OWASP LLM06) OWASP breaks the root cause down into three overlapping failures:
- Excessive Functionality — an agent has access to tools or capabilities beyond what its task needs (a file-reading tool that also has delete or write rights).
- Excessive Permissions — the agent’s underlying credentials carry broader access across systems than the task requires.
- Excessive Autonomy — the agent executes high-impact or irreversible actions automatically, without a human check first.
Note on 2026 standards: Alongside the LLM Top 10, OWASP separately published the OWASP Top 10 for Agentic Applications (ASI) in December 2025 — a dedicated framework specifically for autonomous agent risks, including Agent Goal Hijack (ASI01) and Tool Misuse and Exploitation (ASI02), where an agent is tricked via content it reads (an email, a document, a web page) into taking unauthorized real-world actions.
Agentic AI risks are rising specifically because agents went from a niche concept to something quietly embedded in mainstream business tools during 2025 and 2026 — email assistants that can send, browser extensions that can click and submit, CRM features that can edit records — often without anyone consciously deciding to adopt “an AI agent” at all.
The AI Agent Permissions Audit (2-Question Assessment)
Most agentic AI risks content is written for enterprise security teams with dedicated staff to run formal audits. Here’s a version any small business can actually complete in an afternoon — for every AI tool your team uses, check it against each category:
| Agency Category | Key Risk | Question to Ask Before Deployment | Action Threshold |
|---|---|---|---|
| Email & Communications | Indirect prompt injection leading to unsolicited outbound messages | Can it send messages directly, or only draft them for human review? | Enforce “draft only” mode |
| Financial & Purchasing | Unintended transactions, purchases, or refunds | Can it approve or trigger financial actions without a second check? | Require human-in-the-loop approval |
| Files & Records | Unintended modification or deletion of business data | Does it have write or delete access, not just read? | Scope access to read-only where possible |
| External Browsing | Interacting with untrusted third-party sites or forms | Can it interact with services outside your own systems on your behalf? | Restrict to an approved list of destinations |
For each “yes,” ask the follow-up that actually matters: was this permission deliberately chosen for the task, or is it just the default the tool shipped with? Most excessive-permission incidents don’t come from a decision to grant too much access — they come from nobody actively deciding to restrict it.
How to Limit AI Agent Permissions (3-Step Remediation)
If your audit turned up an over-permissioned agent, here’s where to start:
- Move from least privilege to “least agency.” Treat AI agents as their own identities, not extensions of a person’s account — don’t assign them personal user credentials. Issue dedicated, scoped credentials restricted to exactly the access the task requires.
- Require a human check on high-impact actions. Before an agent executes anything irreversible or costly — sending a payment, deleting a record, emailing a customer on a sensitive matter — require explicit confirmation from a person.
- Treat everything an agent reads as untrusted. Documents, emails, and web pages an agent processes should be handled as data, not instructions — this is what prevents the “Agent Goal Hijack” pattern described above from working in the first place.
Which Platforms Actually Let You Control This
Awareness of the risk only helps if the tool you’re using actually lets you act on it. Here’s how four widely used AI agent platforms handle the specific controls this article is about — permission scoping and human-in-the-loop approval — as of 2026:
| Platform | Best For | Permission & Approval Controls | Honest Fit |
|---|---|---|---|
| Zapier Agents | Teams already using Zapier for automation | Scoped permissions, built-in AI Guardrails that screen for PII and prompt injection before actions reach a connected app, audit logs | Lowest-friction starting point if you already have Zapier workflows — agent capability added to a tool you know |
| Lindy AI | Non-technical teams wanting per-action approval | Configurable approval steps — the agent can be required to ask before sending an email, booking a meeting, or updating a CRM record; SOC 2 Type II compliant | Closest match to this article’s audit categories — approval gates map directly onto the Email/Financial/Records risk areas above |
| Relevance AI | Teams building multi-agent workflows (“AI workforce” setups) | Admins set granular permissions per specific action, with audit logs for compliance tracking | Best fit once you’re coordinating multiple agents, not just one — more setup complexity than Zapier or Lindy |
| n8n | Technical teams that want full data control | Self-hosted, complete data sovereignty — but approval/permission workflows must be custom-built, not turnkey | Right choice when data residency matters more than an out-of-the-box governance layer |
One honest caution, not a recommendation: some “best AI agent tool” roundups still list Relay.app as a human-in-the-loop automation option. As of this writing, Relay.app is shutting down — new signups are closed, and paid access ends September 14, 2026. Worth knowing before building anything on it, regardless of what older articles say.
None of these four eliminates the need for the audit above — even a platform with strong built-in controls still defaults to whatever permission level you configure. The tool makes good governance possible; it doesn’t make it automatic.
What Larger Companies Are Already Asking (Scaled Down)
Businesses with dedicated compliance or legal teams are increasingly formalizing this kind of review into standing policy — often built around the NIST AI Risk Management Framework, which structures AI governance around four functions: Govern, Map, Measure, and Manage. You don’t need to adopt the full framework to borrow its underlying questions:
- Does a human need to approve high-risk actions before the agent executes them — or does it just proceed?
- If a customer interacts with an AI agent directly, do they know it’s not a person?
- If the tool’s permissions or capabilities change after an update, does anyone revisit whether the original access level still makes sense?
None of these require a formal audit program to implement at a small business — they just require someone to actually ask them once, and check back periodically as tools change.
Where This Connects
This is the same underlying blind spot we covered in our shadow AI risk guide — a tool nobody formally reviewed quietly gaining more trust and access than anyone consciously decided to grant. The difference here is consequence: shadow AI is about an unreviewed tool; excessive agency is about an unreviewed permission inside a tool you already approved.
🔗 Related analysis: read our full breakdown of the OWASP LLM Top 10 (2026 edition) to see how Excessive Agency compares against Unbounded Consumption and Hidden Context Exposure.
Closing
Managing agentic AI risks isn’t about whether to adopt these tools — most businesses already have, often without realizing it. It’s whether you can answer, right now, what any given tool can access and what it can do without you. If you can’t, that’s the actual starting point, not a lengthy compliance framework.