Agents lose the ability to infer the same context that humans carry informally, so they guess. Those guesses are often plausible enough to pass review but wrong enough to create downstream defects, duplicated code, and hidden policy violations. Undocumented norms are a control gap because they cannot be enforced consistently.
Why This Matters for Security Teams
Undocumented conventions work only when humans share the same mental model. AI agents do not inherit that implicit context, so they substitute pattern matching for policy, and the result is brittle behaviour that looks acceptable until it is operationalised. In agentic systems, that gap can turn into duplicated workflows, missed approvals, inconsistent secret handling, and silent policy drift across environments. Guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point to the same operational issue: controls must be explicit, testable, and runtime-enforced, not carried in tribal knowledge.
This is why NHI Management Group treats documentation gaps as a security issue, not a process annoyance. Even the best engineers will compensate for missing rules in ways an autonomous agent cannot reliably reproduce. The practical consequence is that the system behaves differently depending on who last edited the code, who reviewed the prompt, or which team “just knows” the convention. In practice, many security teams encounter policy violations only after an agent has already chained the wrong assumptions into production changes.
How It Works in Practice
AI agents need explicit instructions because they cannot safely infer local norms from context alone. If a team assumes “use the standard service account,” “ask before modifying records,” or “mirror the pattern in the last ticket,” those rules may be obvious to a human reviewer but invisible to the agent at execution time. The result is not just a quality issue. It becomes an identity and authorisation problem when the agent can act, call tools, open sessions, or trigger downstream automation.
The control pattern is to replace undocumented convention with machine-enforceable context:
- Define task boundaries in written policy, not in chat history or oral handoffs.
- Bind the agent to workload identity and short-lived credentials so access is issued per task, not assumed from prior behaviour.
- Evaluate authorisation at runtime, using policy-as-code rather than pre-approved “usual access.”
- Log intent, tool use, and approval paths so reviewers can see what the agent believed it was allowed to do.
- Use explicit guardrails for secrets, data scopes, and side effects, especially where the agent can chain tools.
This approach aligns with the direction in OWASP NHI Top 10 and the CSA MAESTRO agentic AI threat modeling framework, which both emphasise that autonomous workloads need runtime controls, not folklore. It also matches the operational posture recommended by MITRE ATLAS adversarial AI threat matrix, where the attacker model assumes dynamic, chained behaviour rather than fixed requests. These controls tend to break down when agents span multiple teams, because each team encodes a different “obvious” convention and no single policy source exists.
Common Variations and Edge Cases
Tighter documentation and policy enforcement often increases operational overhead, requiring organisations to balance speed against consistency. That tradeoff is real, especially when a team is trying to move fast with prototype agents or experimental copilots. Current guidance suggests that some ambiguity can be tolerated in low-risk workflows, but there is no universal standard for how much undocumented convention is acceptable before it becomes a control failure.
Edge cases usually appear where the agent’s action space is broader than the team expected. A support agent may only be meant to draft responses, but if it can access tickets, internal docs, and customer data, vague conventions around “what it usually does” become dangerous. The same is true when teams rely on inherited repository patterns, because agents may reproduce outdated practices with confidence. NHI Management Group’s research on The State of Secrets in AppSec shows how fragile human practice already is, and that fragility gets worse when an agent turns informal handling into automatic behaviour. Related threat patterns are also visible in LLMjacking: How Attackers Hijack AI Using Compromised NHIs, where exposed credentials and weak assumptions create fast-moving abuse paths.
Where teams rely on undocumented conventions across regulated data, production tooling, or multi-agent workflows, the guidance breaks down because no runtime system can consistently recover the missing intent. That is the point where convention stops being convenience and starts becoming risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A06 | Agent misalignment and ambiguous instructions drive unsafe autonomous behaviour. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Undocumented access norms often hide weak secret handling and overprivilege. |
| CSA MAESTRO | GOV-2 | Governance requires clear policy sources for agent actions and approvals. |
| NIST AI RMF | GOVERN | Risk governance depends on explicit roles, accountability, and traceability for AI behaviour. |
| NIST CSF 2.0 | PR.AC-1 | Access control weakens when teams depend on informal conventions instead of enforced rules. |
Assign ownership for agent decisions and require documented risk reviews for each use case.
