The operating agreement that defines how an AI agent behaves in a shared human workspace. It covers who the agent answers to, what it is assigned to do, and which conversations it is allowed to join. Without this contract, presence and authority become guesswork instead of governed access.
Expanded Definition
An AI Agent Social Contract is the operational boundary that tells a deployed agent what it may do, who it serves, and which interactions are within scope. In practice, it sits between policy, delegation, and workflow design: a prompt alone does not establish legitimate authority, and a tool connection alone does not justify participation in a conversation or business process.
For NHIMG, the key distinction is that this concept is governance-first, not model-first. It applies when an agent has execution authority, access to systems, and the ability to take actions that affect people, data, or downstream agents. That makes it closer to a controlled delegation model than a generic usage guideline. Definitions vary across vendors, but the security expectation is consistent: the agent’s role, limits, escalation path, and acceptable context should be explicit before it is allowed to operate.
Industry usage is still evolving, especially where agentic AI systems blend chat, automation, and delegated approvals. The most common misapplication is treating a chat prompt as the social contract, which occurs when teams assume the model’s instructions are sufficient to govern access, authority, and accountability.
Examples and Use Cases
Implementing an AI Agent Social Contract rigorously often introduces approval overhead, requiring organisations to weigh safer delegation against slower automation.
- An IT service agent can answer password reset questions, but it cannot view employee records or join HR case discussions unless its scope is formally expanded.
- A procurement agent may draft vendor comparisons from approved sources, yet it cannot approve a purchase order or negotiate contract terms without a human reviewer.
- A SOC triage agent can summarise alerts and suggest enrichment steps, but its access to case channels is limited to incidents it has been assigned.
- A finance assistant agent may prepare reconciliations from permitted systems, while a separate approval workflow controls any payment-related action.
- An enterprise support agent is allowed to participate in a customer workspace only after identity, tenancy, and tool permissions are explicitly bound to that context.
For a threat-focused view of where agent boundaries break down, security teams often compare these patterns with the OWASP Agentic AI Top 10, which helps surface misuse, overreach, and unsafe tool access. The common thread across use cases is that the contract should be narrow enough to prevent mission creep, but flexible enough to support legitimate delegation.
Why It Matters for Security Teams
An AI Agent Social Contract matters because agentic systems fail most visibly at the seams between authority, identity, and context. If the contract is vague, the agent may enter conversations it should not see, act on data it was never meant to touch, or appear authoritative when it is actually operating outside policy. That creates confidentiality, integrity, and accountability problems at the same time.
This concept also bridges directly into identity governance. When an agent is given a human-like role in a workspace, teams need to decide whether its access behaves more like a service identity, a delegated user, or a tightly constrained workflow component. That decision affects logging, review, revocation, and incident response. The NIST AI Risk Management Framework is useful here because it pushes organisations to define governance, measure risk, and document intended behaviour before deployment.
Organisations typically encounter the consequences only after an agent has joined the wrong channel, exposed the wrong data, or taken an action without valid human intent, at which point the social contract becomes operationally unavoidable to repair.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0, NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | Defines AI governance and risk practices relevant to agent authority and boundaries. | |
| OWASP Agentic AI Top 10 | Covers agentic AI misuse, overreach, and unsafe tool use patterns. | |
| NIST CSF 2.0 | PR.AC-4 | Access control principles apply when agents are granted workspace participation and tool use. |
| NIST SP 800-63 | IAL/AAL | Digital identity assurance helps classify how agent identities and delegated actions are trusted. |
| NIST SP 800-53 Rev 5 | AC-3 | Access enforcement control maps to limiting what an agent can do and see. |
Assess agent permissions, tool access, and conversation scope against agentic abuse scenarios.
