The Block · T6 Security & governance

Least agency

Last reviewed 21 Oct 2026by Pratima Chainani

Giving an agent the fewest tools, the narrowest permissions and the least autonomy that still get the task done, with a human approving anything irreversible.

Least privilege scopes what credentials can reach. Least agency goes further: it also limits which tools an agent has at all, and what it may decide and do without a person in the loop.

It is the 2026 framing for fixing excessive agency, number three on OWASP’s 2026 Top 10 for LLM Applications: a summariser gets read access, not send; credentials are scoped to the user and the task; sending, paying and deleting need a human approval.

Most teams already apply part of it. In Stack Overflow’s 2026 pulse survey, 63% rarely or never let agents run fully on autopilot.

Common misread

Least privilege already covers it.

Least privilege scopes access. Least agency also limits what the agent may decide on its own.

For your code

For each tool: does the task need it, can it be read-only, and does anything it does need a human approval?

For your roadmap

Add “least agency” next to “least privilege” in your security review template.

Sources

  1. OWASP GenAI, LLM Top 10 2026 · Aug 2026
  2. CybersecurityNews, OWASP releases GenAI LLM Top 10 2026 · 6 Aug 2026
  3. Stack Overflow, Agents on a leash (pulse survey) · 27 May 2026