AI agents create governance gaps because flexible, code-driven behaviour can hide why a capability is being used and whether that use is sanctioned. When teams cannot trace memory access, toolchains, or orchestration back to policy, they lose the ability to judge intent. That increases the risk of unsafe actions, compliance drift, and delayed incident detection.
Why This Matters for Security Teams
Runtime intent is the missing control plane for AI agents. Unlike human users, agents can chain tools, retry tasks, call APIs in loops, and change behavior based on intermediate outputs, which makes a simple access review a poor indicator of safety. When security teams cannot see why a capability was used, they cannot reliably tell whether the action was a sanctioned step or an unsafe deviation. That is why guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both emphasize runtime governance, monitoring, and accountability rather than relying only on static permissions.
This is also visible in current NHIMG research. In The State of Non-Human Identity Security, only 1.5 out of 10 organisations are highly confident in securing NHIs, and 85% lack full visibility into third-party vendors connected via OAuth apps. That same visibility gap becomes sharper with agents because the question is not just what access exists, but what the agent is trying to do at the moment it uses that access. In practice, many security teams discover the problem only after an agent has already touched data or executed a toolchain that no one could reconstruct in time.
How It Works in Practice
Good governance for agents starts by treating the workload itself as the identity primitive, then layering intent-aware authorization on top. Static RBAC is often too coarse for autonomous systems because an agent’s access pattern is not fixed in advance. A better model uses workload identity, short-lived secrets, and runtime policy evaluation so each action is judged against current context, task scope, and risk.
In practice, teams map the agent to a cryptographic workload identity, such as SPIFFE or OIDC-backed service identity, then issue OWASP NHI Top 10 and CSA MAESTRO agentic AI threat modeling framework aligned controls at runtime, not just at onboarding. That means:
- issuing JIT credentials per task, with short TTLs and automatic revocation after completion
- evaluating each tool call against policy-as-code, such as OPA or Cedar, with full request context
- logging memory access, retrieval calls, tool invocation, and downstream effects so intent can be reconstructed
- separating permitted capability from permitted purpose, so “can access” does not automatically mean “may use now”
That distinction matters because an agent may have valid credentials and still act outside approved intent if the prompt, retrieved data, or upstream orchestration changes mid-execution. Current guidance suggests runtime authorization should be re-evaluated whenever the task context changes, especially when the agent can call external APIs or other agents. These controls tend to break down in loosely governed multi-agent pipelines because shared state and delegated tool access make the original intent harder to preserve.
Common Variations and Edge Cases
Tighter runtime control often increases latency, policy maintenance, and operational complexity, so organisations have to balance safety against execution speed. That tradeoff is real, especially for production agents that must complete actions quickly across multiple services. Best practice is evolving, and there is no universal standard for intent scoring or agent purpose verification yet.
One common edge case is delegated autonomy, where a primary agent assigns subtasks to other agents. In that model, the original business intent can drift as each agent interprets the goal differently, which is why security teams should define boundaries for tool use, escalation, and data exposure at every hop. Another edge case is long-running workflows, where a short-lived credential expires before the task finishes. The fix is not longer TTLs by default, but better task segmentation and reauthorization checkpoints.
NHIMG’s reporting on agent abuse shows why this matters: in AI Agents: The New Attack Surface report, 80% of organisations reported agents performing actions beyond intended scope, and only 52% could track and audit the data those agents accessed. That gap is especially dangerous in environments with browser automation, email delegation, or code execution, where one prompt can cascade into many tool calls. In those environments, runtime intent is hardest to see exactly when the blast radius is largest.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Agentic misuse and runtime behavior drift are central to this question. |
| CSA MAESTRO | M3 | MAESTRO focuses on threat modeling autonomous agent workflows and delegation. |
| NIST AI RMF | AI RMF addresses governance, measurement, and accountability for AI systems. | |
| OWASP Non-Human Identity Top 10 | NHI-03 | Short-lived credentials and rotation reduce exposure when intent is unclear. |
| NIST CSF 2.0 | PR.AC-4 | Least privilege and access governance are directly challenged by autonomous agents. |
Model agent-to-agent and tool-chain paths, then enforce controls at each delegation step.
Related resources from NHI Mgmt Group
- How should security teams secure AI workloads when posture tools cannot see runtime agent behavior?
- Why do separate security, privacy, and AI risk programs create governance blind spots?
- Why do AI agents create different governance requirements for blockchain investigations and compliance work?
- How should security teams use IAST and RASP in NHI governance?
