A human-agent workflow is the combined operating path that includes the sponsor, the agent, the connected applications, and the approval or escalation points around them. Security review should assess that full chain, because the risk often emerges from their interaction rather than from the model alone.
Expanded Definition
A human-agent workflow is the end-to-end operating path that combines a sponsor, an autonomous agent, the applications it can reach, and the approval or escalation points that shape its actions. In NHI and agentic AI security, the workflow is the control surface, not just the model.
That distinction matters because risk often emerges at the handoff between intent, execution, and oversight. A sponsor may approve an action that is safe in isolation, while the agent’s tool access, stored secrets, or downstream system permissions turn that same action into an unintended change. Guidance across the industry is still evolving, but frameworks such as the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward assessing the full operating context rather than the model alone.
The most common misapplication is treating a human-agent workflow as a simple approval screen, which occurs when teams review the prompt or UI but ignore the agent’s credential scope, escalation path, and target application permissions.
Examples and Use Cases
Implementing human-agent workflows rigorously often introduces latency and coordination overhead, requiring organisations to weigh faster agent execution against stronger oversight and safer blast-radius control.
- A finance approver signs off on an agent that drafts vendor payments, but the workflow limits the agent to read-only ledger access until a human confirms the final release.
- An engineering sponsor allows an agent to open pull requests, while code merge rights remain with a human reviewer and secrets are excluded from the agent’s context.
- A service desk agent can triage tickets and propose password resets, but escalation to a human is required before any account recovery action is executed.
- A security analyst uses an agent to collect evidence from logs and endpoints, with the workflow enforcing step-up approval before any containment command runs.
- NHIMG’s coverage of the OWASP NHI Top 10 shows how agent tool use becomes risky when permissions, tokens, and approval boundaries are not aligned with the intended task.
In practice, the same pattern appears in vendor integrations, internal copilots, and delegated automation. The CSA MAESTRO agentic AI threat modelling framework is useful here because it frames workflow risk as a chain of decisions, not a single interaction.
Why It Matters in NHI Security
Human-agent workflows determine which identities, tokens, and approvals can be used at each step, so they directly influence privilege boundaries, auditability, and incident containment. If the workflow is weak, an agent can inherit more authority than intended, reuse stale secrets, or bypass meaningful review through an over-trusted escalation path.
NHI Management Group reports that 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, which is especially relevant when human approval is used to justify agent autonomy. That figure reflects a practical reality: workflow trust must be anchored in identity, least privilege, and revocation discipline, not in assumptions about user intent.
Security teams should map every sponsor, agent, secret, and downstream system in the workflow, then validate where approvals are advisory versus binding. They should also look for orphaned access, unreviewed escalation rules, and toolchains that can operate after the original requester is gone. Organisations typically encounter the consequences only after an agent has made an unauthorized change or exposed data, at which point human-agent workflow control becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | NHI-02 | Covers agent tool access, escalation, and workflow abuse in agentic systems. |
| NIST AI RMF | Treats AI risk as lifecycle and context dependent, including human oversight. | |
| NIST Zero Trust (SP 800-207) | AC-6 | Zero Trust emphasizes verifying each action and limiting implicit trust in workflows. |
| NIST SP 800-63 | IAL2 | Identity assurance informs when a human approval is strong enough for delegated action. |
| OWASP Non-Human Identity Top 10 | NHI-05 | Workflow risk increases when NHI secrets and permissions are overexposed. |
Map sponsor approvals, tool scopes, and escalation paths to the workflow before enabling execution.
