A common mistake is assuming that strong retrieval automatically means the whole system is production-ready. Retrieval improves answer quality, but it does not provide durable state, conditional branching, or controlled human review. Teams also misread retrieval success as workflow safety, which can hide failures in execution logic and approval handling.
Why Teams Misuse RAG as an Orchestration Layer
Retrieval-Augmented Generation is useful for grounding model output, but it is not a workflow engine, policy controller, or durable executor. Teams get into trouble when they let retrieval results stand in for orchestration logic, then assume the model can safely manage state, retries, approvals, and tool sequencing on its own. That confusion becomes more dangerous in agentic systems, where autonomy expands the blast radius of a bad decision.
This is exactly where agentic AI guidance diverges from generic NHI advice: the problem is not only identity, but also uncontrolled execution. OWASP’s OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward governance, traceability, and runtime controls, not just better prompts or better retrieval. NHI Mgmt Group’s OWASP Agentic Applications Top 10 also highlights how fast tool misuse and prompt injection can turn a seemingly reliable assistant into an unsafe operator. In practice, many security teams discover that retrieval quality improved long before execution safety did, usually after a failed approval path or tool action has already caused damage.
What a Real Agent Stack Needs Beyond Retrieval
RAG should usually be treated as one input to an agent, not the agent platform itself. A usable orchestration layer needs durable state, explicit branching rules, time-bound authorization, and a way to stop or escalate before a high-risk action is taken. It also needs identity controls for the workload, because autonomous systems do not behave like static users with fixed access patterns.
For agentic systems, current guidance suggests separating four layers:
-
Knowledge: retrieval, embeddings, and grounding for context.
-
Decisioning: policy checks that evaluate whether a step is allowed right now.
-
Execution: tool calls, API actions, and side effects with logging and rollback.
-
Governance: approval gates, human review, exception handling, and audit trails.
This is where runtime policy matters more than prewritten flows. The CSA MAESTRO agentic AI threat modelling framework and MITRE ATLAS adversarial AI threat matrix both support the view that agents need continuous evaluation because they can chain tools, change plans, and amplify a small prompt error into a larger operational event. NHIMG data shows why this matters for non-human identities in general: 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface. That is not a reason to avoid RAG, but it is a reason to avoid using RAG as the control plane. These controls tend to break down when teams let a retrieval hit automatically trigger privileged actions in environments with long-lived secrets and weak approval handling.
Where the Model Breaks, and What Teams Need to Watch For
Tighter orchestration often increases latency and operational overhead, requiring organisations to balance speed against control. That tradeoff is real, especially when teams want the convenience of a single agent loop but also need safety for production systems. There is no universal standard for exactly how much state or how many approval gates an agent should have yet, so the design has to fit the task risk.
The biggest edge case is false confidence: a RAG layer can return highly relevant context while the surrounding workflow still fails on branching, retries, or human sign-off. This is why teams should not treat “the answer looked right” as evidence that the whole path was safe. The issue becomes sharper in environments with shared credentials, loosely scoped API keys, or agents that can independently invoke multiple tools. NHIMG’s Ultimate Guide to NHIs — 2025 Outlook and Predictions and the OWASP NHI Top 10 both reinforce the same operational point: identity, secrets, and privilege boundaries must be managed independently of retrieval quality. The practical rule is simple. Use RAG to inform the agent, but use policy, state management, and workflow controls to govern it. Teams usually learn this only after the first unsafe tool call, not during design reviews.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A01 | Covers prompt injection and tool misuse in agent orchestration. |
| CSA MAESTRO | M1 | Addresses agent lifecycle, planning, and execution governance gaps. |
| NIST AI RMF | GOVERN | Supports accountability and oversight for autonomous AI behavior. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Relates to overprivileged non-human identities used by agents. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access is central when agents can invoke tools. |
Separate retrieval, decisioning, and execution with explicit approval and audit controls.
Related resources from NHI Mgmt Group
- What do teams get wrong when they try to use one global role model across all tenants?
- What do teams get wrong when they try to sell IAM as a technical upgrade?
- What do teams get wrong when they move from a prototype agent to production?
- What do teams get wrong when they compare IAM vendors for enterprise use?
