An agent-based system is an AI application that completes work through multi-step execution rather than a single model call. It may plan, reason, retry, and invoke tools in sequence. That structure increases operational flexibility, but it also makes cost, latency, and behavior much harder to predict.
Expanded Definition
An agent-based system is more than an LLM wrapped in a chat interface. It is an AI application that can break a task into steps, choose actions, call tools, inspect intermediate results, and continue until a goal is reached or a stop condition is hit. In practice, that means the system behaves like an orchestrated workflow with decision points, not a single inference event. Definitions vary across vendors, but the security-relevant distinction is whether the system has execution authority and can alter state, not whether it merely generates text.
NHI Management Group treats this as a governance term as much as a technical one, because agentic behavior changes the control surface. A system that can search, write, approve, ticket, or deploy introduces a different risk profile from a passive model. This is why the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework are useful references: they push teams to think about autonomy, oversight, and bounded execution rather than only model quality.
The most common misapplication is calling any chatbot an agent-based system, which occurs when a product generates recommendations but lacks persistent state, tool use, or authority to act.
Examples and Use Cases
Implementing an agent-based system rigorously often introduces workflow complexity and governance overhead, requiring organisations to weigh autonomy against reviewability and cost.
- An IT service desk agent triages requests, gathers missing information, opens tickets, and routes incidents to the right resolver group.
- A security operations assistant enriches alerts, queries logs, drafts containment steps, and escalates only when confidence thresholds are met, a pattern discussed in the MITRE ATLAS adversarial AI threat matrix and related agentic guidance.
- A procurement agent compares supplier responses, checks policy constraints, and prepares a recommendation, but pauses for human approval before submission.
- An engineering agent updates configuration files, runs tests, and creates a pull request after validating tool output and dependency impact.
- A customer operations agent pulls account history, drafts a response, and schedules follow-up actions while preserving a full audit trail.
These use cases are attractive because they compress multi-step work into one operating loop, but they only remain safe when tool permissions, output validation, and escalation paths are designed up front. The CSA MAESTRO agentic AI threat modeling framework is helpful here because it frames the system as a sequence of trust decisions, not a black box with a prompt.
Why It Matters for Security Teams
Agent-based systems matter because they convert model output into operational action. Once a system can invoke tools, access secrets, or update records, mistakes are no longer limited to bad prose. They can become access misuse, unauthorized change, data leakage, or chained failures across connected services. That is why security teams need to assess boundaries, identity controls, and logging around the agent itself, not only around the underlying model.
This term also intersects directly with NHI governance and PAM. Many agent-based systems rely on service accounts, API keys, or delegated tokens, which makes privilege scope and credential lifecycle central to risk reduction. The same logic appears in the OWASP Top 10 for Agentic Applications 2026, where tool abuse, prompt injection, and over-permissioned execution are treated as structural hazards rather than edge cases. NHIMG considers this especially important when agents act on behalf of humans, because the identity behind the action must remain attributable and bounded.
Organisations typically encounter the real impact only after an agent sends the wrong request, exposes a token, or completes an unsafe action, at which point agent-based system controls become operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | OWASP's agentic AI guidance focuses on autonomy, tool use, and agent-specific attack paths. | |
| NIST AI RMF | NIST AI RMF frames governance and risk management for AI systems with autonomous behavior. | |
| OWASP Non-Human Identity Top 10 | Agent systems often depend on service identities, tokens, and delegated credentials. | |
| CSA MAESTRO | MAESTRO models agentic systems as chained trust and control decisions across tools. | |
| NIST CSF 2.0 | PR.AC-4 | Identity and access control are central when an agent can act through tools or accounts. |
Constrain agent permissions, validate tool calls, and review escalation paths before production use.
