An LLM agent is a language model system that can plan, choose tools, remember context, and carry out tasks with limited human intervention. It goes beyond text generation by connecting reasoning to actions, which makes governance, access control, and monitoring much more important than in a basic chatbot.
Expanded Definition
An LLM agent is not just a model that answers prompts. It is a language-model-driven system that can sequence actions, invoke tools, retain useful context, and pursue a goal across multiple steps. That combination creates a governance profile closer to software automation than to a basic conversational interface. In practice, the term is used for systems that can browse, query databases, call APIs, create tickets, or trigger workflows with limited human supervision.
Definitions vary across vendors, especially around how much autonomy is required before a system should be called an agent. NHI Management Group treats the security meaning as the ability to act, not merely the ability to chat. That distinction matters because once an LLM can make decisions with side effects, access control, approval boundaries, logging, and rollback design become core controls rather than afterthoughts. The most common misapplication is calling any chatbot an LLM agent when it has no tool access, no persistence, and no capacity to execute actions beyond text generation.
Examples and Use Cases
Implementing LLM agents rigorously often introduces workflow friction, because every additional tool, approval step, or permission boundary reduces speed while improving safety and auditability.
- A service desk agent drafts a response, checks account status, and opens a ticket, but only after a human approves actions that change entitlements or reset credentials.
- A security operations agent triages alerts, enriches them with threat context, and prepares containment steps, while its tool permissions are restricted to read-only investigation until escalation is authorised. Guidance from the OWASP Agentic AI Top 10 is useful here because it focuses on the attack surface created by tool use and agent autonomy.
- An internal knowledge agent retrieves policy documents, summarises them for staff, and logs the sources it used so reviewers can trace how the answer was produced.
- A developer assistant proposes code changes, runs tests, and prepares a pull request, but cannot merge or deploy without a separate approval gate.
- An identity operations agent helps reconcile account states across systems, which is especially sensitive when it can touch provisioning or deprovisioning workflows that affect NIST AI Risk Management Framework governance concerns.
Why It Matters for Security Teams
LLM agents matter because they introduce agency into systems that can reach into business applications, identity workflows, and sensitive data stores. That creates risks that are different from ordinary model misuse: prompt injection can alter tool selection, overly broad credentials can magnify a mistake into an incident, and weak logging can make post-incident reconstruction impossible. Security teams need to think in terms of permissions, execution boundaries, monitoring, and human override, not just model quality.
This is where agentic AI governance becomes operational. Frameworks such as the OWASP Top 10 for Agentic Applications 2026, CSA MAESTRO agentic AI threat modeling framework, and the NIST AI 600-1 Generative AI Profile help translate abstract concerns into controls for oversight, testing, and safe deployment. Organisational risk rises sharply when an agent is allowed to use secrets, API keys, or privileged service accounts without strict scoping.
Teams usually discover the true impact only after an agent has taken an unsafe action, leaked context, or triggered an unauthorised workflow, at which point LLM agent governance becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST AI 600-1 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Defines common risks for agentic applications, including tool misuse and prompt injection. | |
| NIST AI RMF | Frames governance, mapping, measurement, and management for AI systems with operational impact. | |
| NIST AI 600-1 | Profiles generative AI risks and controls that apply directly to LLM-driven systems. | |
| OWASP Non-Human Identity Top 10 | Covers identity and secret handling patterns that matter when agents use credentials. | |
| NIST CSF 2.0 | PR.AA-01 | Access and identity management guidance applies when agents act with system permissions. |
Review agent tool access, approval gates, and abuse cases against agentic application risks.
Related resources from NHI Mgmt Group
- Should organisations let an LLM decide when an agent workflow is complete?
- How should security teams handle trust assumptions in LLM and AI agent workflows?
- How should security teams govern LLM and agent access in production?
- What should organisations do when an AI agent needs multiple LLM providers?
