A structured way to group agents by how they perceive, decide, and act. In identity terms, the taxonomy matters because each step up in autonomy usually adds more credentials, more delegation paths, and more audit complexity, even when the underlying model is the same.
Expanded Definition
An AI agent taxonomy is a structured classification of agents by autonomy, tool use, memory, planning depth, and the scope of actions they can execute. In NHI security, the classification is not academic: each step up the taxonomy often adds new credentials, broader delegation chains, and more complex audit requirements, even when the model itself does not change.
Industry usage is still evolving, and no single standard governs this yet. Some taxonomies focus on capability tiers, while others separate agents by environment, data sensitivity, or whether the agent can initiate external actions without human approval. The most useful taxonomy for identity governance is the one that maps directly to control boundaries, especially where an agent crosses from read-only reasoning into write access, approval flows, or secret-bearing operations. That framing aligns with the risk themes highlighted in the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework.
The most common misapplication is treating every agent as the same risk class, which occurs when teams ignore differences in credential scope, actionability, and human oversight.
Examples and Use Cases
Implementing an AI agent taxonomy rigorously often introduces governance overhead, requiring organisations to weigh faster automation against tighter identity, approval, and logging controls.
- A low-autonomy support agent drafts responses and retrieves knowledge, but cannot send messages or access production secrets.
- A workflow agent can open tickets and update records, so its NHI must be bound to scoped permissions and monitored for delegated actions.
- An engineering agent, such as those examined in Analysis of Claude Code Security, may write code and trigger tests, which increases the need for provenance and change review.
- An external-facing support bot, like the pattern discussed in Meta AI Instagram Account Takeover, needs stronger guardrails because user interaction can become an identity attack surface.
- A high-autonomy agent that can call APIs, rotate tokens, or invoke other agents should be treated as a privileged identity class, not a simple chatbot.
Taxonomy is especially useful when teams compare how agents are deployed across SaaS, code assistants, and internal orchestration layers. It also helps separate agents that merely recommend an action from agents that can execute it, which is a critical distinction in OWASP NHI Top 10 style threat analysis.
Why It Matters in NHI Security
AI agent taxonomies matter because access design depends on category. If a lower-risk agent is granted the same secrets, tokens, or downstream delegation as a high-autonomy agent, the organisation creates unnecessary blast radius and weakens accountability. That problem is not theoretical: in The State of Secrets in AppSec, GitGuardian and CyberArk report that organisations maintain an average of 6 distinct secrets manager instances, a sign of fragmentation that becomes even harder to govern once agents multiply. In parallel, security teams increasingly worry that AI systems can learn and reproduce sensitive patterns from codebases, as reflected in the same research.
Taxonomy also drives incident response. A simple classification scheme makes it easier to decide which agents may hold long-lived secrets, which must use JIT access, and which should never be allowed direct production actions. Without that discipline, review teams can miss hidden privilege escalation paths, especially when agents chain tools or hand off tasks to other agents. Guidance from CSA MAESTRO agentic AI threat modeling framework and the MITRE ATLAS adversarial AI threat matrix reinforces the need to tie capability tiers to threat scenarios, not labels alone.
Organisations typically encounter the consequences only after an agent is over-privileged, misroutes a secret, or causes an unauthorised action, at which point taxonomy becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Agent taxonomies map autonomy and tool-use differences that OWASP treats as distinct risk surfaces. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Taxonomy affects credential scope, delegation, and auditability for non-human identities. |
| NIST AI RMF | NIST AI RMF frames AI risk by context, function, and potential impact rather than model type alone. | |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero trust logic supports per-agent authorization and minimized trust across tool chains. |
| CSA MAESTRO | MAESTRO organizes agentic AI threats by workflow and trust boundary, which suits taxonomy design. |
Assign NHI controls by agent tier so higher-autonomy agents get tighter secrets and delegation boundaries.
