The sequence of intermediate steps an AI agent takes while trying to complete a task, including reasoning, tool use, and decision timing. Evaluating trajectory matters because a system can appear correct at the end while taking unsafe, inefficient, or unauthorized actions along the way.
Expanded Definition
Agent trajectory is the observable path an AI agent follows from goal intake to task completion, including planning, intermediate reasoning, tool invocation, retries, and stop conditions. In agentic security, the trajectory matters because a safe final result does not prove the path was safe, authorised, or efficient. A trajectory can include unnecessary data exposure, excessive tool calls, privilege escalation attempts, or hidden dependency on an external service that should never have been reached. That is why NHI Management Group treats trajectory review as a governance issue, not just a model-quality metric.
Definitions vary across vendors, but the term is increasingly used in relation to agent observability, approval workflows, and post-execution audit. It overlaps with trace, chain of thought, and execution log, but it is broader than any one of those. Frameworks such as the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10 are useful references because they push organisations to assess not only outputs, but also the decisions and actions that lead to them. The most common misapplication is treating a successful end result as proof of a safe trajectory, which occurs when teams fail to inspect intermediate tool use and authorisation boundaries.
Examples and Use Cases
Implementing trajectory review rigorously often introduces operational overhead, requiring organisations to balance agent autonomy against the cost of logging, approvals, and human review.
- A customer-support agent drafts a refund, checks a ticketing system, and then queries a payment platform. Reviewing the trajectory can reveal whether the payment lookup exceeded the agent’s intended scope.
- An internal research agent uses retrieval and multiple browser tools to compile a report. The trajectory shows whether the agent visited untrusted sources or exposed sensitive prompts to external services.
- A security agent triages alerts and opens a containment action. The trajectory helps confirm whether the escalation happened after validated signals or after a brittle inference step.
- An agent handling secrets requests a token, tests an API, then retries with broader permissions. The trajectory can expose credential misuse even if the final task appears completed.
- In advanced abuse scenarios, trajectory analysis can help compare normal behaviour with patterns described in the MITRE ATLAS adversarial AI threat matrix or the CSA MAESTRO agentic AI threat modeling framework, especially when an agent is manipulated into unsafe multi-step action chains.
Why It Matters for Security Teams
Agent trajectory is important because many real failures happen in the middle of execution, not at the final answer. If security teams only score outputs, they miss prompt injection, over-broad tool access, privilege misuse, and unsafe escalation paths that occur before the agent “succeeds.” That creates blind spots in auditing, incident response, and control validation, particularly where an agent has access to identity systems, secrets, or operational tools. Trajectory also matters for NHI governance because autonomous software entities often act as non-human identities with delegated authority, making their intermediate actions a security event in their own right.
The idea becomes more urgent when agent behavior is investigated after harm. Reports such as Anthropic — first AI-orchestrated cyber espionage campaign report show why teams need to understand action sequences, not just final outputs. Security programs should align telemetry, approvals, and rollback controls so trajectories can be reconstructed and challenged when needed. Organisations typically encounter trajectory risk only after an agent has already taken an unsafe action path, at which point the concept becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and MITRE ATLAS address the attack and risk surface, while NIST AI RMF and NIST AI 600-1 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | Frames AI risk governance around mapping, measuring and managing agent behavior over time. | |
| NIST AI 600-1 | Profiles GenAI risks that include unsafe or untrusted model-mediated actions. | |
| OWASP Agentic AI Top 10 | Covers agentic app risks where multi-step action paths create attack and abuse opportunities. | |
| CSA MAESTRO | Models agentic AI threats across planning, tool use and execution phases. | |
| MITRE ATLAS | Captures adversarial AI techniques that can shape unsafe agent action chains. |
Map each trajectory stage to threat scenarios and add controls at planning, action and output points.
