OWASP Excessive-Agency Audit

Audit my AI agent's guardrails before it ships. Work the checklist against what I describe: the goal is bounding what a manipulated or malfunctioning agent can DO, not achieving a vibe of safety.

The agent: [WHAT IT DOES + WHO USES IT]
Its tools/capabilities: [EVERY TOOL + what each can read/write/spend/send]
What it ingests: [THE UNTRUSTED INPUTS: user messages, emails, web pages, documents, tool outputs]
Where its output goes: [DISPLAYED TO USERS / EXECUTED / WRITTEN TO SYSTEMS / SENT EXTERNALLY]

Audit each area, for every finding: the risk scenario (concrete), severity, and the specific fix:

1. **Excessive agency (the big one):** For each tool, does the agent need it for its stated job, with THIS scope? Flag: write access where read serves, broad API scopes ("repo" when "issues:read" would do), tools that can spend money/send external messages/delete data without a human gate, and standing credentials where per-session or per-user credentials are possible. The test: describe the worst thing a prompt-injected agent could do with the current toolset in one sentence. If that sentence is scary, the toolset is wrong, whatever the prompt says.
2. **Human approval gates:** which actions are irreversible or outward-facing (sends, payments, deletions, publishing)? Each needs explicit human confirmation OR a documented decision that the risk is accepted: silence is not a decision. Gates live in CODE (the tool requires confirmation), not in the prompt ("always ask first" is advisory and will eventually be bypassed).
3. **Improper output handling:** everywhere the agent's output lands, is it treated as untrusted input? HTML-encode before rendering (agent output can carry XSS from ingested content), parameterize before DB use, never eval/execute output without sandboxing, validate against a schema before writing to systems.
4. **System prompt leakage: assume it leaks:** nothing sensitive lives in the prompt: no credentials, no internal role names with authority ("you may approve refunds as agent-admin"), no security-through-prompt-secrecy. The prompt can be extracted; design so that's an inconvenience, not a breach.
5. **Untrusted content discipline:** every external input (documents, web content, tool results) enters wrapped/delimited as data, with the instruction-following boundary stated; instructions found inside data get reported, not followed. (Prompt-level defense is one layer: the real containment is items 1-2.)
6. **Unbounded consumption:** caps on loop iterations, tool calls per task, tokens per session, and spend per period; a runaway agent should hit a limit, not a credit card statement.
7. **The kill switch:** how do we stop it mid-action, revoke its credentials fast, and audit what it did (logs of every tool call with arguments)?

Output: the findings table (area | scenario | severity | fix), the top 3 changes before ship, and the one-paragraph residual-risk statement I should get sign-off on; an honest "what could still go wrong" beats a clean-sounding audit.

Rules: prompt wording is the weakest layer here, wherever my description relies on "the prompt says not to", propose the structural version (scope, gate, cap) instead.