Excessive Agency (LLM Agent Tool Abuse)

Giving an LLM agent broad, unsupervised access to real tools — sending email, executing code, making purchases, modifying records — multiplies the impact of any prompt injection or model mistake from 'said something wrong' to 'did something irreversible'.

Agency = autonomy + tool access + impact; reducing any one of the three shrinks the blast radius of a bad decision, whether caused by injection or ordinary model error

Scope each tool as narrowly as the task actually requires — a 'check order status' tool and an 'issue a refund' tool are very different risk levels and shouldn't share one broad 'manage orders' permission

High-impact or irreversible actions (refunds above a threshold, sending external email, deleting records) should require explicit human confirmation before executing, regardless of how confident the agent's reasoning sounds

Log every tool call an agent makes, with its full reasoning context — when something does go wrong, you need to reconstruct why the model decided to call that tool

Want this flow explained in detail as it plays?

POST/api/agent/run

Headers

Host:app.flowground.dev

Content-Type:application/json

Body

Quick-Insert Payloads

Defense in depth

Give each agent only the specific tools its task requires — a billing-support agent should not have the same tool access as an account-administration agent, even if one human happens to operate both
Require explicit human approval for any tool call above a defined risk threshold (refund amount, role changes, data deletion) — the agent can propose the action, but a person confirms it before it executes
Rate-limit and cap the cumulative impact an agent can have per session/day (e.g. total refund dollars issued) as a backstop, independent of any single decision being individually reasonable-sounding

Vulnerable vs. Fixed

const agent = new Agent({
  tools: [issueRefundTool, updateUserRoleTool, sendEmailTool, deleteAccountTool], // one agent, every tool, no gating
  autoExecuteTools: true, // no human ever reviews a tool call before it runs
});