The process an AI agent uses to find available tools, services, or endpoints that can help it complete a task. In enterprise settings, discovery should be governed so the agent only sees authorized capabilities, not the full environment.
Expanded Definition
AI Agent Service Discovery is the governed process by which an AI agent identifies tools, APIs, workflows, and endpoints it is allowed to invoke in order to complete a task. In enterprise environments, the key issue is not whether discovery exists, but how tightly it is constrained. Unrestricted discovery can expose internal services, privileged functions, or stale integrations that an agent should never see. In practice, this sits between orchestration, authorization, and identity governance, and it should be treated as a control plane capability rather than a convenience feature. The term is still evolving across vendors, but the operational expectation is consistent: the agent should receive only the minimum service surface needed for the assigned context, aligned with principles found in the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework. The most common misapplication is exposing broad service catalogs to an agent, which occurs when discovery is implemented as a simple directory lookup without task-scoped authorization.
Examples and Use Cases
Implementing AI Agent Service Discovery rigorously often introduces routing and policy overhead, requiring organisations to weigh faster task completion against tighter authorization and monitoring.
- An internal support agent can discover only ticketing, knowledge base, and customer lookup services for a case, while finance and HR systems remain undiscoverable.
- A coding agent uses a governed registry to find approved build, test, and deployment tools, similar to the risk themes discussed in Analysis of Claude Code Security.
- A procurement agent queries sanctioned supplier APIs only after policy checks confirm the request scope and business context.
- An operations agent in a microservices environment discovers runtime endpoints through a filtered catalog rather than direct network scanning, reducing exposure to shadow services.
- A support workflow that uses OAuth delegated access must ensure discovery does not reveal high-value connectors, as seen in incidents such as CoPhish OAuth Token Theft via Copilot Studio and the standards guidance in the OWASP Top 10 for Agentic Applications 2026.
Why It Matters in NHI Security
Service discovery becomes an NHI security issue because every discovered endpoint can become a target for credential misuse, privilege escalation, or tool hijacking. If an agent can enumerate too much of the environment, attackers gain a larger blast radius once they compromise the agent, its secrets, or a downstream connector. NHIMG research shows that organisations maintain an average of 6 distinct secrets manager instances, a fragmentation pattern that weakens centralised control and increases the odds that discovery will surface an overexposed integration. That risk is especially dangerous when combined with compromised NHIs, because the agent may inherit access paths it was never intended to use, as illustrated in LLMjacking: How Attackers Hijack AI Using Compromised NHIs and the Ultimate Guide to NHIs. Controls should therefore pair discovery allowlists with telemetry, approval gates, and least-privilege service exposure. Organisations typically encounter the operational cost only after an agent has called the wrong tool, leaked a token, or touched a restricted system, at which point service discovery becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Discovery must not expose secrets or overbroad tool access to agents. |
| OWASP Agentic AI Top 10 | A1 | Agentic applications require guardrails on tool selection and execution scope. |
| NIST CSF 2.0 | PR.AC-4 | Access permissions should be enforced as part of identity and authorization control. |
| NIST Zero Trust (SP 800-207) | SC-? | Zero trust requires explicit verification before any service access is granted. |
| NIST AI RMF | MAP | AI systems should be mapped for context, dependencies, and intended use boundaries. |
Constrain service discovery to authorized capabilities and review exposed connectors regularly.
