A software delivery system that embeds AI agents into a repeatable production workflow. The factory includes the controls around the agents, such as access, evidence, quality gates, and metering, so output can be governed rather than merely accelerated.
Expanded Definition
An agentic software factory is more than an AI-assisted delivery pipeline. It is an operating model where autonomous agents participate in coding, testing, review, deployment, and remediation under explicit governance. The term is still evolving across vendors, but in NHI security it usually implies that agent identities, tool permissions, approval paths, and evidence capture are treated as first-class controls rather than informal workflow details.
This matters because the factory is not defined by speed alone. A real agentic factory establishes who or what the agent can act as, what secrets it can reach, which systems it may touch, and what proof is retained when it changes code or infrastructure. That makes it conceptually close to the control objectives in the OWASP Top 10 for Agentic Applications 2026 and the governance principles in the NIST AI Risk Management Framework, even when those sources do not use the exact same phrase.
The most common misapplication is calling any AI-enabled CI/CD workflow a factory when the agents still operate with broad standing access and no verifiable control boundaries.
Examples and Use Cases
Implementing an agentic software factory rigorously often introduces more approval, identity, and audit overhead, requiring organisations to weigh delivery velocity against the cost of tighter governance.
- An AI agent drafts a pull request, but merge eligibility depends on policy checks, test evidence, and code owner approval before production can change.
- A remediation agent opens a ticket, patches a dependency, and updates a deployment manifest only after it receives just-in-time access to a bounded environment.
- A build agent signs artifacts and publishes them with immutable provenance records, allowing security teams to trace exactly which agent produced which release.
- A support agent inspects logs and stack traces, but it is blocked from raw customer data unless the workflow grants a specific purpose-limited entitlement.
- An orchestration layer routes tasks between agents while limiting secret exposure, a pattern discussed in NHIMG coverage such as OWASP NHI Top 10 and practical incident writeups like Amazon Q AI Coding Agent Compromised.
These patterns align with the general lifecycle concerns reflected in MITRE ATLAS adversarial AI threat matrix, especially where agent actions must be monitored as part of a broader attack surface.
Why It Matters in NHI Security
Agentic software factories concentrate risk because they combine autonomous execution with privileged system access, making NHI sprawl and secret exposure operational issues instead of abstract policy concerns. NHIMG research shows the scale of the problem: 80% of organisations report AI agents have already acted beyond intended scope, while only 52% can track and audit the data those agents access. That gap turns governance into a practical security dependency, not a documentation exercise, and it is reinforced by incidents such as the Moltbook AI agent keys breach and the CoPhish OAuth Token Theft via Copilot Studio.
The security failure mode is usually not a single bad prompt. It is a chain where an agent gets overbroad credentials, reaches a sensitive tool, and leaves little evidence about the action it took. That is why a governed factory must apply least privilege, scoped secrets, workflow attestation, and replayable evidence for every automated step. Organisations typically encounter the consequences only after a compromised agent changes code, leaks credentials, or deploys a harmful artifact, at which point agent governance becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers secret sprawl and overprivileged non-human identities in agent workflows. |
| OWASP Agentic AI Top 10 | A1 | Addresses agentic application risks from uncontrolled tool use and autonomous actions. |
| NIST AI RMF | Frames AI systems as governed socio-technical systems needing mapped risk controls. | |
| NIST CSF 2.0 | PR.AC | Identity and access control are central to limiting what agents can reach or change. |
| NIST Zero Trust (SP 800-207) | Zero trust principles fit agent factories by verifying each tool call and session. |
Minimise agent secrets, scope access tightly, and rotate credentials used by factory automation.
