Start with NIST AI RMF for governance, OWASP Agentic AI Top 10 for application risks, and CSA MAESTRO where multi-agent threat modelling is needed. If the agent acts like a non-human identity, add IAM and NHI governance controls so access, ownership, and revocation are explicit and auditable.
Why This Matters for Security Teams
AI-SPM and agent governance are not just model oversight problems. They are control problems that span data, prompts, tools, identities, and runtime permissions. The most common mistake is treating agents like passive software, when they can retrieve information, invoke APIs, and take actions that create real business impact. That is why governance should start with the NIST AI Risk Management Framework, then map application risk to agent-specific guidance such as the OWASP Agentic AI Top 10.
For security leaders, the practical issue is accountability. If an agent can send messages, change records, trigger workflows, or query sensitive sources, organisations need to know who owns it, what it is allowed to do, and how that access is revoked. That is where identity governance becomes part of AI governance. In practice, many security teams encounter agent risk only after a tool-calling workflow has already accessed data or executed an action that no one intended to permit.
How It Works in Practice
Effective AI-SPM combines governance, threat modelling, and control enforcement. NIST AI RMF provides the programme-level structure for governing risk, measuring impact, and assigning accountability. OWASP Agentic AI guidance helps teams assess application-layer issues such as prompt injection, tool abuse, unsafe delegation, data leakage, and insufficient output validation. For deeper adversarial analysis, the MITRE ATLAS adversarial AI threat matrix is useful for mapping attack techniques to detection and response activities.
Where systems involve multiple cooperating agents, orchestration, or delegated sub-tasks, CSA MAESTRO agentic AI threat modelling framework adds structure for understanding how trust, message flow, and control boundaries work across the system. That matters because the risk profile changes once one agent can call another, share memory, or inherit capabilities.
- Define the AI system boundary, including models, prompts, retrieval sources, tools, and human approval points.
- Assign a named owner for each agent, with explicit lifecycle controls for approval, review, suspension, and revocation.
- Classify the agent’s permissions like any other privileged system, including secrets access, API scopes, and write actions.
- Test for prompt injection, excessive autonomy, data exfiltration, and unsafe output-to-action pathways.
- Log decisions, tool calls, and policy overrides so investigators can reconstruct what the agent did and why.
If an agent behaves like a non-human identity, it should inherit identity governance expectations as well, including least privilege, separation of duties, and auditable access reviews. These controls tend to break down when agents are embedded in fast-moving DevOps pipelines with broad default permissions and no clear ownership.
Common Variations and Edge Cases
Tighter agent governance often increases operational overhead, requiring organisations to balance delivery speed against review, logging, and approval burdens. That tradeoff is manageable for high-impact workflows, but current guidance suggests a lighter approach may be reasonable for low-risk assistants that do not hold credentials, access sensitive data, or trigger external actions. There is no universal standard for this yet, so the governance model should scale with autonomy and blast radius.
One edge case is a model that only drafts content while another service performs the actual action. Even then, the risk may still sit in the surrounding workflow, not the model itself. Another is multi-agent systems where each component appears low risk in isolation, but the chain creates emergent behaviour. For these cases, NHI-style ownership and revocation controls matter because the agent can become an operational identity that outlives the task that created it.
For broader cyber posture, the NIST Cybersecurity Framework 2.0 remains useful for organising governance, protection, detection, response, and recovery around AI-enabled systems. Best practice is evolving, but security teams should treat the AI control set as part of the wider enterprise risk model, not a standalone lab exercise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | Primary governance framework for AI risk, accountability, and lifecycle oversight. | |
| OWASP Agentic AI Top 10 | Targets common agentic application risks like prompt injection and unsafe tool use. | |
| CSA MAESTRO | Useful for threat modelling multi-agent orchestration and trust boundaries. | |
| OWASP Non-Human Identity Top 10 | Relevant when an agent functions as a managed non-human identity with access and revocation needs. | |
| NIST CSF 2.0 | GV.OC, PR.AC, DE.CM, RS.CO | Provides enterprise control structure for governance, access, monitoring, and response. |
Treat persistent agents like identities: assign ownership, least privilege, and revocation.
Related resources from NHI Mgmt Group
- Why is single-provider AI agent governance not enough for enterprise security?
- Which frameworks should organisations use for autonomous AI governance?
- What breaks when organisations use a kill switch for AI agent governance?
- Which frameworks should identity teams use for NHI and AI agent governance?
