The ReAct pattern is an AI workflow that alternates between reasoning, acting, and observing until the task is complete. It improves adaptability and traceability, but it also creates a control surface that must be bounded by permissions, logging, and stop conditions.
Expanded Definition
The ReAct pattern combines stepwise reasoning with tool use and observation, so an agent can refine its next action based on fresh evidence. In practice, this means the model does not simply generate a response once; it plans, executes an action, reads the result, and continues until it reaches a stopping condition. That makes ReAct especially useful where tasks are uncertain, stateful, or dependent on external systems such as search, ticketing, code execution, or identity workflows. NHI Management Group treats ReAct as an orchestration pattern rather than a security control in itself: its security value depends on how tightly tool access, approval boundaries, and telemetry are governed. The pattern is still evolving across vendors, so implementations vary in how much reasoning is exposed, how actions are selected, and how deterministic the loop is. For governance and control mapping, organisations often anchor the surrounding safeguards to NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where logging, access restriction, and auditability are required. The most common misapplication is treating ReAct as a trustworthy decision engine, which occurs when autonomous tool calls are allowed without bounded permissions or a clear stop rule.
Examples and Use Cases
Implementing ReAct rigorously often introduces latency and more moving parts, requiring organisations to weigh agent adaptability against tighter monitoring and approval overhead.
- An internal support agent reasons over a user’s request, queries a knowledge base, and then updates a ticket after observing the result, rather than producing a one-shot answer.
- A security operations assistant gathers alert context from a SIEM, checks enrichment sources, and iterates until it can recommend a triage step or escalation path.
- An NHI governance workflow inspects a service account, observes token age or privilege scope, and decides whether to request renewal, rotation, or human approval before proceeding.
- A developer assistant writes code, runs tests in a sandbox, reviews the output, and revises the approach only within pre-approved execution boundaries.
- A procurement chatbot interacts with an external system, validates a returned status, and continues only if the action does not exceed its delegated authority.
For identity-adjacent use cases, the key question is not whether the agent can reason, but whether it should be allowed to act on secrets, credentials, or privileged APIs at all. That distinction is central to the design of agentic systems and is reflected in guidance from OWASP Top 10 for Large Language Model Applications, which highlights risks around unsafe tool use and excessive agency.
Why It Matters for Security Teams
ReAct matters because it turns a model from a passive generator into an active operator that can trigger side effects. That shift increases usefulness, but it also expands the attack surface through prompt injection, tool misuse, runaway loops, and hidden failure chains between reasoning and execution. Security teams need to know that the core risk is not the reasoning step alone; it is the combination of reasoning with authority to read, write, approve, or invoke systems. In NHI and agentic AI environments, this becomes especially sensitive when the agent can access tokens, rotate secrets, or impersonate service identities. Strong governance requires narrow scopes, explicit stop conditions, full action logging, and clear separation between suggestion and execution. Controls from the CISA Secure AI System Development guidance are useful here, particularly where secure-by-design thinking is needed around agent actions and dependencies. Organisations typically encounter the consequences only after an agent has created, changed, or exposed something it should not have touched, at which point ReAct becomes operationally unavoidable to contain and investigate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | OWASP covers agentic AI risks from tool use, autonomy, and unsafe action loops. | |
| NIST CSF 2.0 | PR.AC-4 | Least privilege and access control govern how an agent may act on systems. |
| NIST SP 800-53 Rev 5 | AU-2 | Audit logging is essential where ReAct agents execute actions and observe outcomes. |
| OWASP Non-Human Identity Top 10 | NHI guidance addresses non-human identities that ReAct agents may use to act. | |
| NIST Zero Trust (SP 800-207) | AC-6 | Zero trust emphasizes dynamic, least-privilege access for every agent action. |
Constrain tool access, approval paths, and stop conditions before enabling agent actions.
Related resources from NHI Mgmt Group
- What is the difference between pattern matching and AI-native classification for sensitive data?
- What breaks when organisations use one Azure identity pattern for every workload?
- Why do standing NHI credentials remain such a high-risk pattern?
- How should security teams implement authentication in React Router apps with server-side rendering?
