When practice owners evaluate an AI voice agent, they ask how smart it is. Can it handle a complicated insurance question. Can it manage an irritated caller. Can it tell Botox from Dysport. Reasonable questions — and almost beside the point. The question that decides what a bad day costs is different: what is this agent allowed to do?

The security field has a name for getting this wrong. OWASP calls it Excessive Agency — LLM06 on the Top 10 for Large Language Model Applications — and it describes any deployment where an agent holds more capability, more permissions, or more autonomy than its job requires. The Thinking Robot builds Revenue Recovery Infrastructure as Lifelike Automations, and we treat agency design as the foundation under everything else. Here is the plain-terms version.

Intelligence Is the Engine. Permissions Are the Brakes.

A language model produces words. What turns words into consequences is tools: the calendar API it can write to, the database it can query, the payment system it can touch, the messages it can send. Each tool an agent holds is a capability — and, in security terms, attack surface. As OWASP's agentic-application guidance puts it, when a model can not only generate text but also execute actions, the blast radius of a single failure expands accordingly.

This reframes the buying question entirely. A brilliant agent with database write access, refund authority, and an open email tool is a larger liability than a modest agent that can do exactly three things. Intelligence determines how often the agent errs. Permissions determine what the error costs.

The Failure Modes of an Over-Permissioned Agent

Excessive agency typically arrives in three forms, and none of them requires an attacker:

• Excessive functionality. The agent has tools it never needed — a "manage records" function when its job is booking, an export capability installed "just in case." Unused capability is pure downside: it cannot help and it can be abused.

• Excessive permissions. The right tool, scoped too wide. An agent that needs to check one day's open slots but holds credentials to read the entire schedule, every patient, all history. Convenient to build, expensive to defend.

• Excessive autonomy. High-impact actions — refunds, cancellations of surgical bookings, record disclosures — executed without a human confirming. OWASP's mitigation list reads like an operations manual: least privilege, just-in-time credentials, human-in-the-loop approval for anything consequential.

And when an attacker does show up, permissions decide the outcome. The 2025 EchoLeak vulnerability against Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3) worked because the assistant could be reached by untrusted input and held broad access to OneDrive, SharePoint, and Teams data. The injection was the spark; the permissions were the fuel. Security researchers now call this combination the "lethal trifecta" — private-data access, untrusted input, and an outbound channel. Remove any leg and the attack collapses.

What Least-Privilege Looks Like on a Practice Phone Line

Our deployments ship with a 4-layer safety stack as standard and a 6-layer stack for healthcare builds, and the agency layer follows three rules:

• Tools are subtracted, not added. Each agent begins with nothing and receives only the functions its role requires. The intake agent books; it cannot export. The reminder agent confirms; it cannot refund. Capability maps to job description, exactly.

• Scopes are narrow and time-bound. Credentials grant the minimum view — this calendar, this window, this field — rather than master keys held permanently.

• Consequential actions route to humans. Anything that moves money, alters a surgical schedule, or discloses records escalates to your staff. The automation does the volume; your team keeps the judgment. That is amplification, not replacement — the agent frees your coordinators from the phone tree precisely so they are available for the calls that need a human signature.

There is a quiet business benefit hiding in this discipline: a narrowly permissioned agent is also a predictable agent. It cannot improvise its way into a liability, which means its behavior on call ten thousand matches its behavior in the demo. Practices evaluating vendors can test for this directly — ask for the tool inventory in writing, and ask which actions require human approval. We hold that conversation openly on our HIPAA-Compliant deployment page, and it is the worldview Nova, our compliance specialist, brings to every medical-grade build: define what the agent cannot do before celebrating what it can.

The industry will keep selling intelligence, because intelligence demos well. Buy the brakes. A practice's revenue recovery math only compounds if the infrastructure doing the recovering is structurally incapable of creating a loss bigger than the leak it plugs.

References

• OWASP GenAI Security Project, "LLM06:2025 Excessive Agency," Top 10 for LLM Applications 2025 — genai.owasp.org (2025)

• OWASP GenAI Security Project, "Top 10 for Agentic Applications" — genai.owasp.org (December 2025)

• Airia, "AI Security in 2026: Prompt Injection, the Lethal Trifecta, and How to Defend" — airia.com (2026)

• eSecurity Planet, "AI Agent Attacks in Q4 2025 Signal New Risks for 2026" (EchoLeak, CVE-2025-32711) — esecurityplanet.com (2025)

Next Step

If your premium practice runs more than 100 inbound consult inquiries a month and has no structured measurement of how many never reach a scheduled consultation, your pipeline is leaking revenue. We quantify this for your practice in a 30-minute Intake Leak Audit.

• Request an Intake Leak Audit: expand@thethinkingrobot.com

• Audit Real-Time Conversational Velocity: Talk to Rosey, our AI receptionist, at +1 (720) 776-1664.