OWASP's list of top risks for LLM applications includes Excessive Agency: an application performing damaging actions in response to unexpected, ambiguous or manipulated output from the model. It names three root causes, excessive functionality, excessive permissions and excessive autonomy, and its mitigations read like an onboarding checklist for a new hire: give the minimum permissions necessary, and have a person approve high-impact actions before they are taken. Here is how to apply each to an AI employee.
1. Functionality: Scope the Role
An AI employee should only see the tools its job needs. In Kavanah that is a capability scope per employee across ten groups, from tasks and projects to email and calendar, clients and deals, finance and administration. A new employee starts with four: tasks, chat, reports and knowledge. Finance and administration are a deliberate addition. A restricted employee never sees a tool outside its scope, in chat, on a schedule or on an assigned task.
2. Permissions: No Wider Than the Person Behind It
NIST defines least privilege as restricting the access of users, or processes acting on behalf of users, to the minimum necessary to accomplish assigned tasks. An AI employee is exactly such a process. In Kavanah it has no login of its own: when it works an assigned task it borrows the role and project visibility of the person who assigned the task, and its scope narrows that further. Separately, an employee can be restricted to named members, and a member off its list cannot use it or learn from the org chart that it exists.
3. Autonomy: Decide What Waits for a Person
Not every action needs a human, and requiring one for everything trains people to click approve. Decide by category. In Kavanah, action policies set for the workspace or for one employee decide, for sending messages, moving money, deleting, membership, deploying, writing to connected tools and spending AI, whether an action runs, runs up to a daily limit, waits for approval or is blocked. Safe mode removes risky tools entirely. And an AI employee can request a person's decision on a task, but no agent tool can approve or reject one.
4. Audit: A Record, and a Way Back
A guardrail you cannot inspect is a hope. Every action a Kavanah agent takes lands in an action ledger, tagged with the employee that took it, and many actions can be undone rather than only read about. The roster's This week view puts one employee's runs, failures, escalations and open nudges on one screen. NIST's AI Risk Management Framework, a voluntary framework for building trustworthiness into AI systems, is a good structure for the periodic review of all of it.
5. Budget: Cap Unattended Spend
The guardrail most teams forget is money. Anthropic notes that the autonomy of agents means higher costs and the potential for compounding errors. Every unattended run in Kavanah, schedules, assigned tasks, meetings and the Water Cooler, is billed in credits and never runs free, and an admin can set one daily token ceiling across all of them. Features that run on their own are off until an admin turns them on.
Scope the role, bound the access, decide what waits, keep the record and cap the spend. Those five answer the three causes OWASP names. For how Kavanah's AI employees and other vendors' agents compare on each, see our AI employees page.
