Control-flow integrity means an agent follows its intended sequence of actions even when it encounters hostile or misleading input. In LLM systems, it reduces the chance that prompt injection can redirect tool choice or execution order, but it does not automatically protect the values carried through those actions.
Expanded Definition
Control-flow integrity is a security property that keeps an agent, program, or model-driven workflow on its intended execution path, even when input is adversarial, malformed, or misleading. In software security, the term is often used to describe protections against unintended jumps, redirects, or execution hijacking; in agentic AI, it is increasingly used to describe whether an AI agent can be steered away from its approved tool sequence or action order. Definitions vary across vendors because some teams use the term narrowly for low-level program execution, while others apply it to orchestration logic in LLM systems and agent runtimes. For a governance lens, the closest broad reference point is NIST Cybersecurity Framework 2.0, which helps teams frame integrity protections inside a wider risk-management program.
For NHIMG, the important distinction is that control-flow integrity protects sequencing and decision order, not the correctness of the data a workflow carries. A system can preserve its intended control flow and still process poisoned content, unsafe secrets, or misleading outputs. The most common misapplication is treating prompt filtering or content moderation as control-flow integrity, which occurs when teams assume blocked inputs alone prevent an agent from reaching unsafe tool calls or altered execution branches.
Examples and Use Cases
Implementing control-flow integrity rigorously often introduces design constraints, requiring organisations to balance agent flexibility against stronger execution control and auditability.
- An internal support agent is allowed to classify tickets, but its tool chain is locked so it cannot reorder escalation steps or skip mandatory approval checks.
- A code-execution pipeline verifies that a build agent only invokes approved actions in the expected sequence, reducing the risk of injected instructions changing the workflow path.
- A fraud-investigation assistant can summarise evidence, but it cannot be redirected by prompt injection into calling privileged systems outside its permitted branch logic.
- An orchestration layer for an LLM workflow enforces step ordering so that retrieval, policy checks, and response generation happen in the declared sequence rather than in attacker-influenced order.
- Security teams use standards such as the OWASP Top 10 for Large Language Model Applications to reason about where prompt injection and tool misuse can undermine intended control paths.
Why It Matters for Security Teams
Control-flow integrity matters because many real-world compromises do not require breaking cryptography or stealing credentials. They succeed by altering what happens next. In conventional systems, that can mean redirecting execution into unsafe code paths; in agentic AI, it can mean steering an autonomous software entity toward an unapproved tool, privileged action, or disclosure path. That makes the concept especially relevant where AI agents have execution authority, access to secrets, or integration with IAM and PAM workflows. The security problem is not limited to model quality. It is about preserving authoritative decision order under hostile input and ensuring the agent cannot be manipulated into violating policy.
Teams that work from the NIST Cybersecurity Framework 2.0 mindset typically treat this as an integrity and governance issue, then map it to technical enforcement in runtime policy, tool allowlists, and step-level validation. For agentic systems, guidance from OWASP is useful for identifying where prompt injection and tool abuse can disrupt execution order. Organisations typically encounter control-flow integrity failures only after an agent performs an unexpected action, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST AI 600-1 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | Protects access and authorisation paths that support controlled execution order. |
| OWASP Agentic AI Top 10 | Covers agentic AI risks where tool use and execution flow can be manipulated. | |
| NIST AI RMF | Addresses AI risk governance, including resilience against manipulated system behaviour. | |
| NIST AI 600-1 | GenAI profile emphasises secure and trustworthy operation of generative systems. | |
| OWASP Non-Human Identity Top 10 | Relevant where agents use non-human identities to access tools and services. |
Enforce least privilege so agents can only follow approved action paths and tool sequences.
Related resources from NHI Mgmt Group
- What is the difference between access control and data-flow control for agents?
- What breaks when mobile banking apps treat device integrity as a binary control?
- Why do data integrity and access control matter so much for AI assistants in security operations?
- When does hashing fail as an integrity control?
