An agentic coworker is an AI system treated as a working collaborator rather than a one-off assistant. It can take tasks, produce outputs, and continue work across steps. Security and governance depend on durable state, clear boundaries, and monitored access so the agent remains accountable.
Expanded Definition
An agentic coworker is more than a chat interface or a task-specific copilot. It is an AI system assigned durable work, expected to retain context, and allowed to act across multiple steps with some degree of execution authority. In NHI security, that means the system must be governed like a persistent identity with bounded access, not treated as a disposable prompt session.
Definitions vary across vendors, but the common distinction is between an assistant that answers and an agent that persists. The security posture changes when the AI can read files, call APIs, open tickets, send messages, or trigger workflows on its own. That makes the surrounding identity controls, approval gates, and audit logging part of the object being governed. The OWASP Top 10 for Agentic Applications 2026 and the NIST AI Risk Management Framework both reinforce that persistent AI behavior requires explicit risk treatment, not informal trust.
The most common misapplication is treating an agentic coworker like a normal chatbot, which occurs when teams grant durable credentials and workflow access without defining scope, approval, or revocation rules.
Examples and Use Cases
Implementing an agentic coworker rigorously often introduces workflow friction, requiring organisations to weigh productivity gains against tighter approvals, narrower entitlements, and more complex audit design.
- A support-resolution agent drafts responses, retrieves account context, and updates the CRM across multiple turns, but only after its access is limited to specific queues and record types.
- A developer-facing agent opens pull requests, runs tests, and proposes fixes, while a human reviewer retains authority over merges and production-impacting changes.
- A procurement agent gathers vendor quotes and prepares purchase requests, but it cannot approve spend or modify supplier banking details without a separate control.
- An internal research agent scans documents and summarizes findings, yet its access is constrained so it cannot expand into adjacent repositories or exfiltrate sensitive data.
- NHIMG’s OWASP NHI Top 10 shows how agentic behavior becomes a security issue when tool access, secrets, and execution scope are not separated.
- The MITRE ATLAS adversarial AI threat matrix is useful when the coworker’s inputs can be manipulated through prompt injection, poisoned content, or adversarial workflow triggers.
Why It Matters in NHI Security
Agentic coworkers create a larger attack surface than ordinary automation because they combine identity, memory, tool access, and decision-making in one persistent system. If that system is over-permissioned, compromised credentials can be reused at machine speed, actions can occur outside intended scope, and investigations become difficult when logs do not show which data the agent touched. NHIMG research found that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface.
This is why NHI governance must include durable identity binding, least privilege, scoped secrets, session and state review, and clear revocation paths. The same operating model applies whether the agent uses an internal API, a third-party connector, or delegated human accounts. The LLMjacking: How Attackers Hijack AI Using Compromised NHIs research underscores how exposed credentials can be abused quickly once an agent is trusted to act. Organisations typically encounter the risk only after an agent sends data, executes a harmful action, or accesses a system it was never meant to reach, at which point the agentic coworker model becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Covers identity binding and lifecycle issues for persistent non-human actors. |
| OWASP Agentic AI Top 10 | A1 | Defines agentic application risks from tool use, memory, and autonomous execution. |
| NIST AI RMF | Frames AI systems as risk-bearing assets requiring governance and monitoring. | |
| NIST Zero Trust (SP 800-207) | SCG-1 | Zero Trust requires explicit verification for every access decision made by an agent. |
| CSA MAESTRO | Addresses threat modeling and control design for agentic AI systems. |
Assign each agent a scoped identity, monitor its lifecycle, and revoke access when its role changes.
