A non-deterministic workload is a system whose runtime behaviour changes based on input, context, or reasoning rather than following a fixed execution path. AI agents fit this model because prompts, tool outputs, and retrieval results alter their process, network, and data access patterns.
Expanded Definition
A non-deterministic workload is not defined by a single fixed runbook. Its behaviour can shift as prompts change, retrieval results differ, tool calls succeed or fail, and external context alters the next action. In modern security operations, this most often describes AI agents and other systems that have execution authority, access to data, and the ability to choose between paths rather than repeat one predictable sequence.
That makes the term especially relevant in identity, cloud, and AI governance discussions. A workload may still be “the same service” from an infrastructure perspective, yet its identity, permissions, and network patterns can vary from one invocation to the next. This is why workload identity and policy enforcement matter: the runtime is not reliably inferable from code alone. Standards and guidance are still evolving, but concepts in the SPIFFE workload identity specification help teams treat the workload as an authenticated, continuously evaluated entity rather than a static process.
The most common misapplication is treating a non-deterministic workload like a conventional microservice, which occurs when teams assume its access pattern, tool use, and data exposure will remain stable across runs.
Examples and Use Cases
Implementing controls for non-deterministic workloads rigorously often introduces policy overhead, requiring organisations to weigh adaptive capability against tighter monitoring and access constraints.
- An AI customer-support agent decides whether to answer from its own context, query retrieval systems, or call internal tools, so each request can produce a different access path.
- A code-assist agent reads repository state, proposes edits, and then executes tests, with each tool result changing what it does next.
- A SOC automation workflow uses an LLM to summarise alerts, but the summary can change depending on incident context, which affects downstream triage and escalation.
- A financial operations assistant pulls different records depending on user intent, meaning its data access profile is not fixed at deployment time.
- An autonomous research agent chooses between web search, internal knowledge bases, and document parsing, making runtime behaviour dependent on available evidence.
For AI systems, NIST guidance increasingly treats this variability as a governance issue, not just an implementation detail. The NIST AI 600-1 GenAI Profile and NIST IR 8596 Cyber AI Profile both reinforce the need to understand how AI-driven decisions affect security posture.
Why It Matters for Security Teams
Security teams need to understand non-deterministic workloads because traditional controls assume repeatable behaviour. When runtime paths are variable, static allowlists, narrow process assumptions, and one-time testing can miss the real exposure. The practical risk is that the workload may request broader data, invoke a new tool, or interact with a different service than expected, creating an attack surface that changes as the system reasons.
This is where identity and authorisation become central. A non-deterministic workload should be governed as a workload identity with scoped entitlements, continuous verification, and explicit policy for each action rather than blanket trust in the enclosing application. That aligns well with the NIST Cybersecurity Framework 2.0, which emphasises governance, protection, and continuous risk management across dynamic environments.
Organisations typically encounter the real cost of a non-deterministic workload only after an agent reaches an unintended tool, accesses data outside its intended scope, or produces a harmful action path, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Agentic systems are explicitly variable at runtime and can take different action paths. | |
| CSA MAESTRO | MAESTRO addresses security controls for autonomous AI workflows and their changing behaviour. | |
| NIST AI RMF | AI RMF applies to systems whose outputs and actions vary with context and inputs. | |
| NIST CSF 2.0 | GV.RM | Risk management guidance fits dynamic workloads with shifting access and behaviour. |
| OWASP Non-Human Identity Top 10 | Non-human workloads need identity and entitlement discipline when execution paths vary. |
Record non-deterministic runtime risk in governance processes and update controls as behaviour changes.
Related resources from NHI Mgmt Group
- How should security teams red team non-deterministic AI systems?
- What breaks when penetration testing tools are non-deterministic on sensitive networks?
- Why do non-deterministic agent outputs create governance problems?
- Why do non-deterministic AI systems create governance risk in security pipelines?
