The transition of AI agents from experimental sandboxes to critical production and business processes requires moving away from unstructured prompt chaining toward structured orchestration. Granting generative AI freedom of action without strict boundaries leads to unpredictable operational consequences. This is why the OWASP GenAI Security Project has classified "excessive agency" as a critical security risk for 2025, alongside threats like prompt injection (LLM01:2025) and sensitive information disclosure (LLM02:2025).
The primary challenge for CTOs and system architects today is to integrate autonomous agents into the corporate landscape while avoiding the "black box" problem, where an agent makes unauthorized or unvalidated decisions, bypassing standard corporate governance and compliance rules.
Anatomy of the excessive agency risk: why AI freedom threatens business
The essence of the excessive agency problem lies in granting AI agents direct, uncontrolled access to APIs and tools without clearly defined process boundaries. This allows large language models (LLMs) to independently determine task execution logic, creating room for errors or manipulation. When an agent is allowed to act autonomously without supervision, critical incidents occur.
Consider three real-world examples of such failures in enterprise systems:
- Unvalidated API calls: An AI agent for processing customer returns gains access to a payment gateway and initiates an external API call for a transaction without passing DMN validation of financial limits.
- Bypassing approvals (human-in-the-loop): A procurement agent approves supplier invoices independently, ignoring the mandatory human approval step that should be defined in the BPMN model.
- Creation of shadow processes: Process logs reveal that an agent systematically ignores mandatory compliance checks because it independently found a faster, yet non-compliant, path to execute tasks.
BPMN 2.0 as a digital enclosure: turning the agent into a predictable service node
To minimize the risk of excessive agency, the system architecture must prevent AI from independently determining the sequence of steps. BPMN 2.0 (Business Process Model and Notation) acts as an executable standard for agent orchestration, ensuring visibility into the state of every process instance.
In this paradigm, an AI agent is treated as a single, strictly limited node—an isolated Service Task. It has no direct access to third-party systems. The process engine manages the execution token, verifying that the AI's output meets system requirements. Governance frameworks should prioritize the visibility of API calls initiated by agents, routing them exclusively through the orchestration engine rather than allowing direct, uncontrolled access.
DMN (Decision Model and Notation): separating decision logic from execution
A common architectural mistake is embedding decision logic directly into an agent's system prompt. This not only reduces predictability but also makes it impossible to implement quick changes to business rules without risking an impact on the model's overall behavior.
The DMN (Decision Model and Notation) standard allows for the separation of business rules from the process flow. Instead of relying on the probabilistic assessment of an LLM when approving financial transactions, the AI agent is used only for context preparation or data extraction. The actual decision is made using declarative DMN tables. This allows system administrators to modify decision logic without needing to redesign the entire BPMN model or alter prompts.
Auditing and detecting shadow processes with process mining
It is important to understand that while BPMN and DMN limit an agent's ability to violate rules, architects also require tools for retrospective control. This is where process mining technology proves invaluable. It is not intended to predict future agent errors; rather, it is a powerful tool for analyzing historical event logs.
Process mining analyzes logs to reveal how processes are actually executed. This allows for the identification of bottlenecks and unauthorized "shadow" process routes, where an agent has found a workaround that deviates from the reference BPMN model.
Architectural pattern for secure AI agent orchestration
Reliable AI implementation in corporate processes requires a technology stack that supports deep orchestration. An example of a platform that combines AI flexibility with the rigor of corporate standards is the low-code solution Scriptum (developed by InBase, based on the UnityBase platform from the Intecracy Group alliance).
Instead of granting agents uncontrolled access to databases, Scriptum allows for the construction of rigid BPMN/DMN orchestration scenarios. In this architecture, AI acts exclusively within the bounds of pre-modeled business processes as a microservice. This ensures that critical actions require two-factor confirmation or a human-in-the-loop step, eliminating the risks of unauthorized transactions.
| Level / Component | Direct autonomy (Dangerous) | Managed orchestration (Safe) |
|---|---|---|
| API access level | Agent forms and sends requests itself | Agent generates only parameters; orchestrator validates and executes the call |
| Decision making | Dynamic prompting: AI decides based on context | DMN tables: Decisions are made by strict business rules outside the AI model |
| Human control | Fully autonomous: Agent closes transactions independently | Human-in-the-loop: Critical steps require operator confirmation in a BPMN task |
| Logging and auditing | Internal agent log: Logic is difficult to trace | System Event Log: All actions are recorded in the BPM system log for process mining |
Full protection against the risks of excessive agency lies in perceiving the AI agent not as a "smart employee," but as an instrumental service operating within the strict digital perimeter of an orchestrator.
FAQ
How does OWASP define the excessive agency risk in LLM systems?
The OWASP LLM Top 10 2025 project defines excessive agency as a specific class of risk arising from uncontrolled decision-making by AI agents and granting them excessive authority or tool access, which can lead to unauthorized actions.
How can an AI agent be integrated into an existing BPMN business process schema?
An AI agent should be integrated as an isolated Service Task. It receives input parameters from the orchestrator, performs processing, and returns data, while the process engine makes decisions about the next step based on the BPMN model.
Why is using DMN better than writing rules inside an agent's system prompt?
DMN allows for the separation of business rules from the process flow and the language model's logic. This ensures deterministic decision-making and allows rules to be changed without redesigning the entire BPMN model or risking behavioral changes caused by prompt modifications.