Agent usage refers to AI systems that plan tasks, call tools, retry actions, and chain multiple model invocations within one workflow. Unlike a single chat interaction, agent usage creates runtime decisions that may need identity, scope, and revocation controls.
Expanded Definition
Agent usage describes the operational pattern where an AI system is allowed to decide the next step, invoke tools, inspect outputs, and continue a task loop without a human approving every action. In practice, that can include search, code execution, ticket creation, email drafting, database queries, and API calls. The security concern is not the model prompt alone, but the runtime authority attached to the agent and the sequence of actions it can take.
This makes agent usage different from a single chat interaction, a scripted workflow, or a simple retrieval step. It introduces questions about who granted the agent access, what scope it received, how long that scope lasts, and how to revoke it if behaviour changes. Guidance is still evolving, but the OWASP Agentic AI Top 10 treats this as a distinct risk area because tool use and autonomous chaining create new abuse paths.
The most common misapplication is treating an agent as if it were only a conversational interface, which occurs when organisations grant broad tool access without defining per-action limits, session boundaries, or revocation rules.
Examples and Use Cases
Implementing agent usage rigorously often introduces governance overhead, because each tool call may need its own scope, logging, and review path, requiring organisations to weigh autonomy against control.
- An IT service desk agent reads a ticket, queries a knowledge base, and proposes remediation steps, but is only allowed to open a change request after a human confirms the action.
- A security operations agent correlates alerts, enriches indicators, and drafts response actions, while its ability to quarantine endpoints is restricted to a short-lived approval window.
- A procurement agent collects vendor documents, validates required fields, and updates a workflow system, but cannot view payment details unless a separate entitlement is issued.
- A developer assistant runs tests, creates a pull request, and posts a summary, while each repository action is logged as a distinct agent transaction for review.
- A research agent gathers sources and synthesises findings, but cannot forward messages or access shared drives unless the workload owner explicitly delegates that scope.
These examples reflect the control challenges described in the NIST AI Risk Management Framework and the CSA MAESTRO agentic AI threat modeling framework, both of which emphasise governance, traceability, and bounded operation for AI systems that act rather than merely respond.
Why It Matters for Security Teams
Security teams need to understand agent usage because the risk surface changes once an AI system can chain actions across multiple systems. A prompt injection that would be annoying in a chat interface can become material when the same agent has access to secrets, admin consoles, or internal data stores. That is why agent usage often intersects with identity governance: the agent may need a distinct non-human identity, narrowly scoped credentials, time-bound approval, and a clear revocation path when trust is lost.
In mature programmes, the relevant question is not whether an agent is useful, but whether its authority is bounded well enough to survive misuse, prompt manipulation, and unexpected tool output. Teams should also align monitoring with threat patterns documented in the MITRE ATLAS adversarial AI threat matrix and the OWASP Top 10 for Agentic Applications 2026, especially where tool misuse, over-permissioning, and uncontrolled chaining are present.
Organisations typically encounter the consequences only after an agent has sent data, changed records, or executed a privileged action outside intent, at which point agent usage becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Defines common risks for agentic systems that call tools and chain actions. | |
| NIST AI RMF | GOVERN | Sets governance expectations for AI system oversight and accountability. |
| NIST CSF 2.0 | PR.AC-4 | Access control guidance applies when agents receive scoped runtime permissions. |
| OWASP Non-Human Identity Top 10 | Covers non-human identities that may represent autonomous AI agents in systems. | |
| CSA MAESTRO | Threat modeling for agentic AI focuses on tool use, delegation, and abuse paths. |
Model agent workflows for misuse, escalation, and uncontrolled action chaining.
