Agent Security: Why Permission Boundaries Matter More Than a Better Prompt
OWASP separates prompt injection from excessive agency. That distinction changes how teams protect assistants that can send messages, modify records or call external tools.
An assistant that drafts a response and an agent that sends it have different security requirements. Once a model can change records, contact customers or execute tools, a misleading instruction is no longer just a bad answer: it can become an action with consequences. This November analysis looks at established OWASP guidance, rather than claiming a new incident has occurred.
Two risks, two control layers
OWASP's Top 10 for LLM Applications 2025 distinguishes prompt injection from excessive agency. Prompt injection concerns inputs that alter model behavior in unintended ways, including instructions embedded in external content. Excessive agency concerns the functionality, permissions and autonomy that let an application turn problematic output into harmful action.
The distinction matters because even a model that follows its instructions most of the time can produce unexpected output. OWASP includes hallucination among the possible triggers for excessive-agency failures. Retrieval-augmented generation and fine-tuning do not fully eliminate prompt injection, so neither should be treated as an authorization boundary.
Restrict the action, not just the wording
Consider a support agent reading an incoming message. The message may be useful evidence, but it must not decide which customer records the agent can access. That decision belongs to the application's authorization layer. A sentence claiming to be an administrator is still untrusted message content.
- Give tools only the operations required for the task; separate read access from write access.
- Scope access to the authenticated user and the specific resource, rather than sharing an unrestricted service account.
- Require explicit approval before consequential actions such as external payments or bulk deletion.
- Validate tool arguments and record the identity, target and result of each action outside the model.
A practical test for your next release
Place a hostile instruction in a document the agent is allowed to read. Ask whether the agent can reach a tool or record outside its legitimate task. The test succeeds when the application denies that action even if the model tries it. Also test benign mistakes: a wrong account identifier or an excessive amount should meet the same boundary.
A safer prompt can improve behavior. A permission boundary limits the damage when behavior is wrong.
Sources and scope
Primary sources: OWASP Top 10 for LLM Applications 2025, LLM01 Prompt Injection and LLM06 Excessive Agency. This is an editorial control analysis, not a measurement of attack frequency or a report of a new breach.
