Because the agent is no longer using one stable capability set. Routing introduces multiple model tiers, each with different cost, context, and output characteristics, so governance must control when escalation is allowed and how those decisions are logged. In practice, model routing becomes part of the authorisation surface for the agent.
How routing changes the governance target
Model routing turns “the agent” into a policy-driven decision chain rather than a single fixed capability. A request may stay on a low-cost model, escalate to a stronger model, or be rerouted based on context, so governance has to cover the routing logic itself, not just the agent’s prompt, tools, or output filters.
That changes the identity governance problem because access is no longer only about who the agent is, but also about which model is authorised for which action. Routing rules can effectively grant or deny higher capability, so they should be treated as part of the agent’s authorisation model for AI agents and reviewed with the same care as other delegated permissions.
It also means governance needs a record of why escalation happened. If routing decisions are opaque, teams lose the ability to distinguish a legitimate upgrade from an abuse path, especially when the higher-tier model has broader context, stronger tools, or different data exposure. AI agent observability, audit and incident response becomes part of proving that routing stayed within policy.
Why routing expands the attack and abuse surface
Routing creates multiple trust boundaries. A lower-tier model may be safe for routine drafting, but escalation can expose additional context, permissions, or external actions that were not needed at the start of the workflow. That introduces a new control question: whether the escalation path itself can be triggered too easily, manipulated, or reused across tasks.
This is why routing belongs in the same governance conversation as least privilege and per-action decisioning. If a route can reach a more capable model without a clear business rule, the agent’s effective authority grows in ways the original policy may never have intended. Practical guidance for task-scoped and just-in-time access applies directly here, because model selection is itself a privilege decision.
Routing also creates a possible abuse path through prompt manipulation, task shaping, or context inflation. An attacker does not need to defeat the strongest model if they can induce the agent to route a benign request into a more permissive one, or to move from a cheap “analysis” tier into a tier that can see more data or take stronger actions. That makes routing policy a governance control, not just an optimisation feature.
What good governance needs to prove
Good governance does not require one model for every task. It requires clear rules for when a route may change, who or what can request escalation, and what evidence is retained after the change. In practice, the system should be able to show that the route followed policy, the decision was attributable, and the resulting capability change was bounded.
Teams should also treat routing as part of the agent’s lifecycle and identity posture. The governance question is not only “can the agent act?” but “which model identity or service path is acting now, under what policy, and with what retained context?” When routing is explicit, agent identity, delegation and lifecycle become easier to govern because escalation and retirement points are visible.
Where routing is used for high-impact tasks, model changes should be logged alongside the request, policy reason, and resulting action. That gives reviewers enough evidence to decide whether the escalation was legitimate, whether the policy needs tightening, and whether a human approval gate is warranted for certain thresholds.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Routing changes which model authority is used for an action. |
| ASI09 — Human-Agent Trust Exploitation | Routing decisions can be manipulated through trust in the agent's judgment. | |
| Recommendation — Restrict escalation paths so higher-authority model use requires explicit policy. Require approval or review when routing could amplify impact. | ||
| NIST AI RMF | GOVERN — Govern | Routing policy is an AI governance decision that needs accountability and oversight. |
| Recommendation — Define, review and monitor routing policy under AI governance. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | Routing changes should be logged to preserve attribution and reviewability. |
| AC-6 — Least Privilege | Dynamic model selection can expand effective privilege if not constrained. | |
| Recommendation — Log routing decisions, escalation reasons and resulting actions. Limit routing so each task gets only the authority it needs. | ||
Practitioner Guidance
What to verify: Verify that every routing rule has a business justification, a clear escalation trigger, and an explicit audit trail. If the higher-tier model can see more context or take stronger actions, treat that as an access change rather than a performance tweak.
Decision rule: If a route can change the agent’s data access, tool reach, or action authority, require policy review before deployment and log the route decision at runtime. If the route only changes cost or latency, the governance burden is lighter.
What practitioners underestimate: The hardest part is not choosing the best model, it is proving that the agent did not silently gain extra authority through routing. Once routing becomes dynamic, governance must follow the decision path, not just the endpoint model.
Practitioner takeaway: Model routing changes governance because capability is now conditional and time-varying, so control has to cover escalation rules, attribution, and the authority increase created by each route.