AI agents can act with real permissions, access sensitive data, and make decisions at machine speed, so they belong in the risk model. If organisations only assess human users, they miss a growing part of the workforce and its attack surface. The practical goal is to evaluate what each identity can access, how it behaves, and whether that behaviour creates exposure.
Why This Matters for Security Teams
Human risk programmes were built to understand people, but AI agents now sit inside the same business processes and often inherit the same access pathways. That changes the risk equation. An agent can read emails, query systems, call APIs, and trigger actions without the natural friction that limits human behaviour. As a result, access analysis that stops at employee accounts leaves a blind spot around delegated machine action, lateral movement through service credentials, and high-volume misuse of legitimate privileges.
The issue is not only identity, but behaviour. A human may take minutes or hours to create a risky action; an AI agent can do so at machine speed, across many systems, and with outputs that look operationally normal until damage is already under way. Guidance from the NIST AI Risk Management Framework and the OWASP Top 10 for Agentic Applications 2026 both point to governance, visibility, and control over agentic behaviour as core requirements, not optional extras.
For NHI Management Group, the practical question is simple: if an agent can act on behalf of the organisation, it belongs in the same risk lens as any other privileged identity. In practice, many security teams encounter agent-driven exposure only after data has already been copied, workflows have already been altered, or transactions have already been executed, rather than through intentional behavioural review.
How It Works in Practice
Effective human risk analysis for AI agents starts by treating each agent as an identity with a defined purpose, scope, and control boundary. That includes the credentials, tokens, API keys, service accounts, and orchestration permissions the agent uses to act. If the programme only monitors login events or endpoint activity, it misses the real control plane, which often lives in workflow engines, SaaS integrations, model toolchains, and cloud services.
Security teams should map three things together: what the agent can access, what it is allowed to do, and what it actually does over time. This is where behaviour analysis becomes essential. An agent that normally drafts summaries but suddenly exports records, calls privileged tools, or chains actions across systems should be treated as a risk signal. The same principle appears in the MITRE ATLAS adversarial AI threat matrix and CSA MAESTRO agentic AI threat modeling framework, which both emphasise adversarial manipulation, tool abuse, and chained failure modes.
A practical operating model usually includes:
- inventorying AI agents, their owners, and their business purpose
- classifying each agent’s permissions, secrets, and delegated authority
- tracking normal versus anomalous tool use, data access, and action volume
- binding agent access to least privilege and short-lived credentials where possible
- logging prompts, tool calls, outputs, and downstream actions for review
This is where NHI and human risk programmes converge. The OWASP Non-Human Identity Top 10 is especially relevant when the agent relies on persistent secrets or weak lifecycle control, while NIST SP 800-53 Rev 5 Security and Privacy Controls provides a control baseline for access, auditability, and configuration discipline. These controls tend to break down in fast-moving SaaS environments where agents are created ad hoc and their tokens outlive the workflow they were meant to support.
Common Variations and Edge Cases
Tighter agent monitoring often increases operational overhead, requiring organisations to balance detection quality against automation speed. That tradeoff is real, especially where AI agents are used for customer support, SOC assistance, software delivery, or finance workflows. Best practice is evolving, and there is no universal standard for exactly how much autonomy should be allowed without human review.
Some environments will justify stronger controls than others. A sales assistant that drafts emails may need limited monitoring, while an agent that can approve transactions, retrieve regulated data, or call production APIs should be analysed much like a privileged service account. The same applies when agents share credentials with humans, because attribution becomes unclear and risk scoring degrades quickly.
Current guidance suggests that programmes should not only ask whether an agent is authentic, but whether its behaviour is explainable, bounded, and revocable. That is also why identity governance teams should align with the NIST Cybersecurity Framework 2.0, which reinforces asset visibility, protective controls, detection, and response as connected functions rather than isolated tasks. For higher-risk deployments, the Anthropic report on the first AI-orchestrated cyber espionage campaign report shows why agent behaviour cannot be assumed benign simply because the system is automated.
The edge case that often surprises teams is a low-code or shadow-AI workflow that inherits broad permissions through an admin account or integration token. In that scenario, risk analysis fails because no one intended to create a “privileged agent,” yet one now exists.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATLAS and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Agentic app risks map directly to autonomous tool use and unsafe actions. | |
| NIST AI RMF | AI RMF covers governance, mapping, measurement, and management for AI risk. | |
| MITRE ATLAS | ATLAS models adversarial abuse of AI systems, including agentic workflows. | |
| OWASP Non-Human Identity Top 10 | Agents often depend on secrets and identities that need lifecycle control. | |
| NIST CSF 2.0 | PR.AC-1 | Access control is central when agents inherit real permissions and sensitive access. |
Assess agent permissions, tool use, and guardrails before allowing autonomous execution.
