A long-running operation is a task that continues beyond a single request and response cycle. In agentic systems, this allows work to proceed asynchronously while the user disconnects or moves on. It is important because it supports multi-step workflows, but it also requires resumability, state management, and reliable completion reporting.
Expanded Definition
A long-running operation is a task that continues after the initial request returns, with progress, state, and completion handled asynchronously. In agentic systems, this pattern is used when an AI agent needs time to collect data, call tools, wait for approvals, or execute multi-step workflows without blocking the user session.
In NHI and IAM contexts, the key distinction is not duration alone but operational continuity: the identity, permissions, and execution context must remain valid across reconnects, retries, and handoffs. That means practitioners need durable job state, idempotent actions, and clear ownership of who can resume or cancel the operation. Standards guidance is still evolving here, so definitions vary across vendors and platforms. A useful reference point for governance outcomes is the NIST Cybersecurity Framework 2.0, which reinforces recovery, logging, and access discipline around ongoing processes.
The most common misapplication is treating a long-running operation like a simple request, which occurs when teams fail to preserve state and authentication context after the initiating session ends.
Examples and Use Cases
Implementing long-running operations rigorously often introduces state-management and retry complexity, requiring organisations to weigh user experience and automation depth against traceability and control.
- An AI agent opens a security ticket, pauses for human approval, then resumes tool execution after authorization is granted.
- A provisioning workflow creates an NHI, waits for secret issuance, and completes only after policy checks confirm least privilege.
- A discovery job scans service accounts over several hours, checkpointing results so it can resume after a transient API failure.
- A rotation task stages new credentials, validates dependent workloads, and reports completion only when the old secret is safely revoked.
- A compliance workflow tracks an async evidence collection run, using durable identifiers so auditors can verify the full execution path.
These patterns are especially important when organisations are trying to reduce secret exposure and improve lifecycle control, a concern highlighted in the Ultimate Guide to NHIs. For implementation language, the asynchronous job model in NIST Cybersecurity Framework 2.0 is a practical anchor for resilience and observability.
Why It Matters in NHI Security
Long-running operations matter because they extend the security boundary beyond a single API call. If resumability is weak, teams may create duplicate actions, orphaned workflows, or stale privileges that remain active after the original task has ended. If completion reporting is unreliable, operators can incorrectly assume a credential was rotated, a service account was disabled, or an agent workflow was safely terminated.
This is where NHI governance becomes tangible. NHIMG reports that 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage, which shows how durable execution paths can amplify the impact of poor secret handling when they are not tightly controlled in Ultimate Guide to NHIs. The risk is not only exposure during execution but also after the task finishes, when cached tokens, queued retries, or unfinished approval chains can still be abused. The most common operational failure is assuming the workflow ended cleanly when the worker timed out or the user closed the client.
Organisations typically encounter the true cost only after an incident review, at which point long-running operation handling becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Async agent workflows need safe state, approval, and tool-use boundaries. |
| OWASP Non-Human Identity Top 10 | NHI-04 | Long-running jobs rely on durable identity context and controlled credential use. |
| NIST CSF 2.0 | DE.CM | Ongoing operations require monitoring to detect stalled, duplicated, or abused workflows. |
| NIST Zero Trust (SP 800-207) | SC-2 | Continuous verification applies when execution resumes across sessions or retries. |
| NIST AI RMF | GOV 3.1 | AI risk governance must cover persistent state, traceability, and human oversight. |
Design resumable agent jobs with explicit checkpoints, approval gates, and cancel paths.
