AI agents and external tools complicate context security because they can inject, reuse, or forward data across multiple hops, each with different trust assumptions. Without tight identity and permission checks, a valid token can still carry unsafe context. That creates room for prompt forgery, memory pollution, and unauthorized action inside the reasoning flow.
Why This Matters for Security Teams
Context security becomes difficult the moment an AI agent can carry state across multiple tools, prompts, and APIs. A token that looks valid at issuance can still become dangerous after it is reused in a different trust zone, wrapped into a new prompt, or forwarded into a downstream connector. That is why agentic workflows create risk in places where standard session thinking breaks down. Current guidance in the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework treats this as a lifecycle problem, not just a prompt filtering problem.
NHIMG research shows the gap is already operational: in The State of Non-Human Identity Security, only 1.5 out of 10 organisations said they were highly confident in securing NHIs. That confidence gap matters more in agentic systems because the same identity can be used for tool calls, memory writes, retrieval, and side effects. In practice, many security teams encounter context leakage only after an agent has already forwarded sensitive data or triggered an unsafe action, rather than through intentional review.
How It Works in Practice
Agentic workflows usually involve a chain of context hops: user input enters the model, the model creates an internal plan, the agent calls one or more tools, and each tool returns fresh data that may re-enter the reasoning loop. At every hop, the trust boundary changes. If identity and authorisation are not re-evaluated at runtime, the agent can inherit more power than the task needs, and that power can persist across steps.
Security teams should treat the agent as a workload identity, not as a human user. That means using cryptographic identity primitives such as SPIFFE or OIDC, then binding each tool call to policy decisions that are evaluated at request time. Static RBAC is often too blunt here because the agent’s path is not fully known in advance. Better patterns are emerging around context-aware or intent-based authorisation, where the system checks what the agent is trying to do, what data it is trying to touch, and whether the current task justifies that access.
- Issue short-lived, task-scoped credentials instead of reusing long-lived secrets.
- Separate read, write, and execute permissions for tools and connectors.
- Log every context injection, tool invocation, and memory write with identity and purpose tags.
- Revoke access automatically when the task completes or the plan changes.
NHIMG’s AI Agents: The New Attack Surface report found that 80% of organisations said their agents had already performed actions beyond intended scope, which is consistent with the failure mode described in the NIST Cybersecurity Framework 2.0: control must follow the asset, not the assumption. These controls tend to break down when agents are allowed to chain tools across loosely governed SaaS environments because policy context is lost between systems.
Common Variations and Edge Cases
Tighter context control often increases orchestration overhead, so organisations have to balance agent productivity against the cost of more frequent policy checks and token refreshes. That tradeoff is real, especially where agents operate across legacy apps, shared service accounts, or vendor-managed connectors.
Best practice is evolving, but current guidance suggests three recurring exceptions. First, retrieval-heavy systems need extra protection around memory pollution, because bad data can be reintroduced as if it were trusted context. Second, external tools that can write, delete, or trigger workflows deserve stricter controls than read-only tools, even if they share the same agent. Third, multi-agent pipelines need segmentation so one agent’s context does not become another agent’s authority. The CSA MAESTRO agentic AI threat modeling framework is useful here because it emphasizes tool trust, orchestration paths, and control points between agents.
For practitioners, the hardest edge case is the “valid token, wrong context” problem. That is why NHI controls and agent controls need to be aligned with pages like OWASP NHI Top 10 and NHIMG’s coverage of issues such as CoPhish OAuth Token Theft via Copilot Studio. These controls matter most where agents can act on behalf of users without a fresh human approval step, because that is where context and authority diverge fastest.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Agent tool use and context hops are core agentic attack paths. |
| CSA MAESTRO | TA-2 | MAESTRO addresses orchestration and trust between agents and tools. |
| NIST AI RMF | GOVERN | AI RMF governance supports accountability for autonomous context use. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Short-lived identities and secrets reduce unsafe context reuse. |
| NIST Zero Trust (SP 800-207) | AC-3 | Zero trust requires rechecking trust at each context boundary. |
Model each agent-tool boundary and enforce controls where context crosses trust zones.
Related resources from NHI Mgmt Group
- How should security teams govern AI agents that use Model Context Protocol?
- How should security teams govern AI agents using Model Context Protocol?
- Why do AI agents complicate performance comparisons between security tools?
- How should security teams implement AI agents in cloud and application security workflows without losing control over context and risk?
