Protect-and-continue is a control pattern that removes or obscures sensitive fields while allowing the agent workflow to proceed. Instead of blocking the entire call, the system redacts, masks, or tokenizes only the risky content. This reduces operational friction while preserving security, auditability, and the usefulness of the agent response.
Expanded Definition
Protect-and-continue is a selective enforcement pattern used in agent workflows, copilots, and other automated systems that need to keep operating after encountering sensitive content. Rather than stopping a request outright, the control removes, masks, or tokenizes only the fields that create risk, then lets the remaining task proceed. That makes it different from blanket blocking, which sacrifices utility, and different from simple logging, which may retain sensitive data without changing how the workflow behaves. In identity-heavy environments, the pattern often appears where secrets, personal data, or privileged instructions may cross trust boundaries during tool use or message routing.
NHI Management Group treats the pattern as an operational control choice rather than a single technical mechanism, because implementations vary across vendors and platforms. Some systems apply field-level redaction before model inference, while others sanitize outputs after retrieval or before downstream delivery. The security objective is consistency: preserve the business action while reducing exposure of credentials, tokens, and other sensitive material. The most common misapplication is treating protect-and-continue as simple masking at the interface, which occurs when the underlying sensitive content is still available to the agent, logs, or connected tools.
Examples and Use Cases
Implementing protect-and-continue rigorously often introduces a tradeoff between response fidelity and data minimisation, requiring organisations to weigh operational continuity against the risk of overexposing context.
- An AI support agent receives a user message containing an API key, and the system redacts the key before the prompt is forwarded, allowing the case to continue without exposing the secret.
- A workflow engine handling identity verification masks national identifiers in the response payload while preserving non-sensitive fields needed for case routing and escalation.
- A code assistant retrieves configuration text that includes credentials, then tokenizes the secrets before the model uses the content, reducing the chance of accidental disclosure.
- A privileged operations agent processes incident notes that contain access tokens, and the orchestration layer strips the tokens before the tool call is executed.
- A policy engine applies selective redaction to PII in chat transcripts, aligning the workflow with guidance from the NIST Cybersecurity Framework 2.0 on governing and managing cyber risk without unnecessarily disrupting service.
Why It Matters for Security Teams
Protect-and-continue matters because security teams rarely want every risky interaction to become a hard stop. In practice, blocking entire agent actions can create shadow IT, prompt users to bypass controls, or cause automation to fail in high-volume operations. Selective protection helps preserve productivity while still reducing the likelihood that secrets, tokens, or personal data will flow into model context, downstream logs, or third-party tools. For NHI and agentic AI environments, this is especially important because non-human workloads often move faster than manual review can keep up, and a single leaked credential can expand access across multiple systems.
The control also supports auditability when paired with clear policy and traceability, because teams can show that sensitive fields were removed rather than merely trusted. That distinction becomes important for governance, incident response, and data minimisation obligations. Relevant practices can be aligned with the NIST Cybersecurity Framework 2.0 for risk management and with identity assurance principles from NIST SP 800-63 when sensitive identity data is in scope. Organisations typically encounter the full cost of poor selective controls only after a data leak, a failed audit, or an agent misuse event, at which point protect-and-continue becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS | Protect-and-continue reduces sensitive data exposure while systems keep operating. |
| NIST SP 800-63 | Identity data handling is relevant when protect-and-continue processes personal or verifier-facing fields. | |
| OWASP Non-Human Identity Top 10 | Selective redaction helps prevent NHI secrets and tokens from flowing into agent context. | |
| OWASP Agentic AI Top 10 | Agentic systems need guarded context handling to avoid unsafe disclosure while continuing tasks. | |
| NIST AI RMF | Risk management is relevant because the pattern balances utility, privacy, and security in AI systems. |
Apply data security controls so sensitive fields are minimized, masked, or tokenized before further processing.
Related resources from NHI Mgmt Group
- How should security teams protect sessions from infostealer-based attacks?
- How should security teams protect NHI secrets stored in AI workflow platforms?
- How should security teams protect source code repositories from identity abuse?
- How should security teams protect non-human identities from infostealers?
