Discovery and posture review can show that an agent exists and appears compliant, but they do not prove the agent behaves safely under real conditions. If runtime controls are missing, a prompt injection, a bad tool chain, or a weak MCP definition can still drive unintended access and data movement. Visibility without enforcement leaves the organisation observing risk instead of reducing it.
Why Discovery and Posture Review Are Not Enough
Discovery tells security teams what exists, and posture review tells them what looks compliant at a point in time. Neither proves that an agent will behave safely once a prompt changes, a tool is chained, or a workflow reaches an unexpected branch. That gap matters because agentic systems act with execution authority, not just visibility. The current guidance from OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point to runtime risk as the real control gap, not inventory alone. NHI Management Group’s Ultimate Guide to NHIs notes that NHIs outnumber human identities by 25x to 50x in modern enterprises, which makes “find it and file it” governance especially brittle at scale.
The practical mistake is assuming a clean posture report implies safe operation. In reality, agents can still inherit overbroad secrets, accept manipulated input, or invoke tools in ways no static review anticipated. In practice, many security teams encounter abuse only after the agent has already moved data or executed an unsafe action, rather than through intentional validation of runtime behaviour.
How Runtime Controls Change the Outcome
Runtime controls shift the question from “does this agent exist?” to “what is it allowed to do right now, in this context?” That usually means moving beyond static RBAC and toward intent-aware authorisation, short-lived secrets, and request-time policy evaluation. The best practice is evolving, but the direction is consistent across CSA MAESTRO agentic AI threat modeling framework, MITRE ATLAS adversarial AI threat matrix, and NIST AI RMF: enforce at execution time, not only at review time.
- Issue workload identity to the agent, not just a shared service credential, so the platform can prove what the agent is and constrain it accordingly.
- Use JIT credentials with tight TTLs so access exists only for the current task and can be revoked automatically when the task ends.
- Evaluate policy at request time with context such as tool, data sensitivity, task type, and environment state.
- Separate “can the agent be discovered” from “can the agent act,” because those are different control planes.
This is where operational evidence matters. NHIMG’s OWASP NHI Top 10 and its companion agentic applications guide show how prompt injection, tool misuse, and unsafe chaining become control failures when runtime guardrails are absent. Static posture can confirm that an agent is registered and its secrets are present; it cannot confirm that a malicious instruction will be blocked before the agent calls a downstream system. These controls tend to break down when agents share credentials across environments because revocation, attribution, and blast-radius containment all become ambiguous.
Common Variations and Edge Cases
Tighter runtime control often increases operational overhead, requiring organisations to balance safety against latency, developer friction, and policy sprawl. There is no universal standard for agent authorisation yet, so implementation varies by risk profile and autonomy level. High-trust internal helpers may tolerate narrower guards, while externally exposed agents need stronger isolation and more aggressive revocation.
One common edge case is delegated tool use inside multi-agent pipelines. A single agent may look benign in posture review, but once it hands work to another agent or calls an embedded MCP server, the trust boundary shifts. Another is long-running workflows, where a credential that looked acceptable at issuance becomes overexposed mid-task. Current guidance suggests treating these systems as dynamic workloads, not static identities.
Teams should also watch for false confidence from visibility tools. Analysis of Claude Code Security and Gemini AI Breach – Google Calendar Prompt Injection both underscore a simple reality: discovery may be accurate, yet enforcement still fails when the agent is asked to act in a hostile context. In practice, posture-only programmes usually fail first in environments with shared tools, broad API permissions, and weak revocation discipline.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Agent misuse emerges when runtime behavior is not controlled. |
| CSA MAESTRO | T1 | MAESTRO focuses on threat modeling agent workflows and tool use. |
| NIST AI RMF | GOVERN | AI RMF governance covers accountability beyond simple discovery. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Short-lived credentials reduce exposure when posture checks miss runtime abuse. |
| NIST CSF 2.0 | PR.AC-4 | Least privilege must apply to machine identities at runtime. |
Add request-time checks so agent actions are blocked unless context and intent are approved.
