A chat interface that can decide how to complete a request by selecting tools, sequencing steps, and adapting its behaviour during the session. In governance terms, it behaves like a delegated non-human actor, so access, logging, and approvals must follow the execution path rather than the prompt alone.
Expanded Definition
Agentic Chat is not just a conversational interface. It is a chat experience that can translate a user request into an execution path, choosing tools, ordering actions, and adapting mid-session based on results, policy checks, or failures. In NHI governance, that means the chat layer can function as a delegated non-human actor with operational authority, not merely a text front end.
That distinction matters because the security model must follow the action chain, not only the prompt. A request may start as a harmless question, then become a file read, API call, approval workflow, or environment change after tool selection. Industry usage is still evolving, but the control expectation is already clear in OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework: govern autonomy, tools, and downstream impact as a single risk surface. The most common misapplication is treating agentic chat like a static chatbot, which occurs when teams log prompts but do not control the tools, privileges, or side effects that the session can trigger.
Examples and Use Cases
Implementing agentic chat rigorously often introduces approval latency and tighter tool boundaries, requiring organisations to weigh user convenience against the risk of unsupervised execution.
- A support copilot opens tickets, queries internal knowledge bases, and drafts responses, but only after policy checks limit what customer data it may retrieve.
- An engineering assistant uses a signed deployment toolchain to run tests and prepare a release, while privileged steps require human approval and full audit capture.
- A finance workflow agent pulls invoice status, reconciles records, and escalates exceptions, but cannot move funds unless a separate control is satisfied.
- An incident-response chat can gather logs, enrich alerts, and isolate hosts, aligning with the execution model discussed in the AI LLM hijack breach research and the MITRE ATLAS adversarial AI threat matrix.
- An access-review assistant recommends privilege changes, but the actual entitlement updates are deferred until a reviewer approves the recommendation.
In practice, agentic chat is useful wherever a session needs to move from conversation to controlled action, as highlighted in OWASP NHI Top 10 and the CSA MAESTRO agentic AI threat modeling framework.
Why It Matters in NHI Security
Agentic chat matters because it can inherit and expand NHI risk in real time. If the session holds credentials, can invoke tools, or can access shared data sources, then a single compromise may expose secrets, sensitive records, or production systems. NHIMG research on AI agent behaviour shows that 80% of organisations report agents performing actions beyond intended scope, while only 52% can track and audit the data those agents access. That is a governance failure, not just a UX issue.
The threat becomes sharper when attacker behaviour targets the session boundary. In NHI environments, the model can be manipulated into becoming an execution broker, especially when permissions are broad and logging is incomplete. This is why LLMjacking and Ultimate Guide to NHIs are relevant references for understanding how non-human access can be abused once it is operationalised inside a chat flow. Organisations typically encounter the full impact only after an agent has already accessed data, issued actions, or exposed credentials, at which point agentic chat becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Covers agentic app risks from tool use, autonomy, and unsafe action chains. |
| OWASP Non-Human Identity Top 10 | NHI-02 | Addresses secret handling and credential abuse in non-human execution paths. |
| NIST AI RMF | Defines risk governance for AI systems that make or influence operational decisions. |
Bind agentic chat sessions to least-privilege NHI credentials and rotate exposed secrets quickly.
