Draft-Only Agent

A draft-only agent can prepare content or suggested actions, but it cannot take external write actions on its own. This pattern reduces operational risk by keeping a human in the loop at the point of execution. It is especially useful when trust is still being earned and mistakes are hard to reverse.

Expanded Definition

A draft-only agent is an AI or software agent that can compose proposed content, recommendations, or workflow steps, but cannot independently commit write actions to external systems. In NHI and agentic governance, that constraint is the control boundary: the agent may draft an email, change request, ticket comment, or remediation plan, yet a human must approve the final execution.

This pattern is narrower than general human-in-the-loop automation because the agent is intentionally denied the ability to invoke sensitive APIs, publish records, rotate credentials, or alter production state. It is often used as a maturity step before broader delegation, especially when the operational blast radius is unclear or the data quality behind the recommendation is uneven. Guidance across OWASP Top 10 for Agentic Applications 2026 and the NIST AI Risk Management Framework supports this kind of constrained autonomy, but definitions vary across vendors on where “draft-only” ends and “approval-assisted execution” begins.

The most common misapplication is treating a draft-only agent as if it is operationally harmless, which occurs when its output is copied into production without the same review discipline applied to privileged actions.

Examples and Use Cases

Implementing draft-only behavior rigorously often adds review overhead and slower turnaround, requiring organisations to balance automation speed against the cost of human approval.

• A security agent drafts a token rotation plan from inventory data, but a PAM administrator must approve the change before any secret is touched.
• An incident-response agent prepares a containment checklist and suggested API revocations, while a responder executes the approved steps manually in the console.
• An access-governance agent recommends RBAC changes after a privilege review, but the actual role update is staged for sign-off in the change system.
• A developer assistant drafts a merge request comment or patch suggestion, yet cannot push code or trigger a deployment job on its own.
• An NHI hygiene workflow drafts offboarding actions for stale service accounts, with execution delayed until identity owners verify business impact, a pattern discussed in the Ultimate Guide to NHIs — 2025 Outlook and Predictions and related OWASP NHI Top 10 analysis.

This model is especially useful where mistakes are hard to reverse, such as revoking the wrong credential, deleting the wrong record, or publishing an unsafe response. It also aligns well with agentic security research such as the CSA MAESTRO agentic AI threat modeling framework, which emphasizes separating reasoning from execution authority.

Why It Matters in NHI Security

Draft-only agents reduce the risk that a compromised prompt, flawed retrieval, or manipulated tool suggestion becomes an immediate privileged action. That matters in NHI environments because service accounts, API keys, certificates, and automation tokens are already high-value targets, and the boundary between suggestion and execution is where many identity failures start. NHI Mgmt Group’s Ultimate Guide to Non-Human Identities reports that 97% of NHIs carry excessive privileges, while 96% of organisations store secrets outside of secrets managers in vulnerable locations, creating a large attack surface if an agent is allowed to act directly.

Draft-only controls also support Zero Trust thinking by refusing implicit trust in generated output. A proposed remediation can still be wrong, stale, or adversarially influenced, so execution authority should remain separate until the recommendation is validated against policy and context. This is consistent with the NIST AI Risk Management Framework and the MITRE ATLAS adversarial AI threat matrix, both of which stress reducing downstream harm from manipulated model behavior.

Organisations typically encounter the cost of ignoring draft-only boundaries only after a bad suggestion is approved and executed, at which point the control becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• AI Agent Authentication
• What breaks when an AI agent can draft and publish content without approval?
• What is agent communication poisoning?
• What is a shadow agent and why is it more dangerous than a typical shadow NHI?