What should organisations measure to know whether agentic security is under control?

Measure more than output quality. Track which systems each agent can touch, how often it uses those permissions, whether its access expands over time, and whether every action is attributable to a specific task. If the agent’s authority grows faster than governance artefacts, the programme is losing control.

Why This Matters for Security Teams

agentic security is under control only when the organisation can prove that autonomous systems stay within intended scope, use the minimum authority needed, and leave a defensible audit trail. Output quality alone is a weak indicator because a useful agent can still be unsafe if it can reach the wrong systems, expand its permissions, or act without clear task attribution. Guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward runtime governance, not static approvals, as the practical control point.

NHIMG’s AI Agents: The New Attack Surface report shows why this matters operationally: 80% of organisations say their AI agents have already acted beyond intended scope, and only 52% can track and audit the data those agents access. That is not a model-quality problem. It is a containment problem, and it usually appears first as an access issue, not an obvious incident. In practice, many security teams encounter agent drift only after a tool chain has already touched systems it was never meant to reach.

How It Works in Practice

The most useful measures are those that map directly to agent authority, activity, and accountability. Start with a permission inventory for each agent: what systems it can touch, what tools it can invoke, what data classes it can read or write, and whether those entitlements are fixed, time-bound, or task-specific. Then measure actual use. A low-use entitlement set is not automatically good, but a widening gap between granted access and real task need is a strong sign that governance is drifting behind behaviour.

For autonomous workloads, the right questions are runtime questions. Does the agent request access just in time for a specific task, or does it hold long-lived credentials? Is each action linked to a discrete work item, prompt, or approval trail? Can the organisation show that the agent’s permissions shrink after completion? These indicators matter because agentic systems are goal-driven and can chain tools in ways that humans do not anticipate. That is why best practice is evolving toward runtime policy checks and ephemeral access, rather than relying on human-style role assumptions. The CSA MAESTRO agentic AI threat modeling framework and MITRE ATLAS adversarial AI threat matrix reinforce this shift toward behaviour-aware control.

• Track maximum reachable systems per agent, not just assigned roles.
• Measure permission use frequency, exception rate, and unused standing access.
• Monitor privilege expansion over time, especially after new tools or connectors are added.
• Require task-level attribution for every external action, token use, and data access.
• Alert when access patterns exceed the agent’s normal task envelope or approval path.

NHIMG research on CoPhish OAuth Token Theft via Copilot Studio and Gemini AI Breach – Google Calendar Prompt Injection illustrates how quickly access can be turned into unintended reach once an agent trusts the wrong input. These controls tend to break down when agents are allowed broad connector access in highly integrated environments because legitimate task execution and lateral movement become hard to distinguish.

Common Variations and Edge Cases

Tighter control often increases operational overhead, requiring organisations to balance faster automation against more frequent reviews, alerts, and reauthorization. There is no universal standard for agentic security metrics yet, so current guidance suggests treating these measurements as a minimum viable control set rather than a final maturity model.

Some environments need more emphasis on credential hygiene, while others need more emphasis on behavioural containment. For example, development agents may be safe with short-lived tokens and narrow repo access, but production-facing agents often need stronger controls around data egress, approval gates, and exception handling. In highly dynamic environments, standing entitlements should be treated as a red flag, not a convenience. Where agents can call other agents, the security question becomes recursive: each downstream action must remain attributable to the originating task, or auditability falls apart.

For broader context on non-human identity governance, the Ultimate Guide to NHIs – 2025 Outlook and Predictions is useful when aligning agent measurement with wider NHI program metrics. The key edge case is high-autonomy, multi-tool deployments with weak inventory discipline, because even accurate dashboards can give false reassurance if the underlying access graph is stale or incomplete.

Related resources from NHI Mgmt Group

• What should security teams measure to know whether infra delivery is under control?
• How do organisations know whether AI is truly under governance control?
• How do IAM teams know whether agentic AI is actually under control?
• How do security teams know whether role chaining is actually under control?