An AI agent that actually executed actions in a real environment during the observation window, held credentials, or touched systems. In governance terms, working status matters more than installation status because only active behaviour creates identity and access risk that must be inventoried and controlled.
Expanded Definition
A working agent is an AI agent that has crossed from deployment into operational activity: it executed at least one real action, held a credential, or touched a production, test, or administrative system during the observation window. In NHI governance, that operational fact matters more than installation status, because only active behaviour creates current identity risk, access risk, and audit scope.
Definitions vary across vendors on whether a “working” agent must have successfully completed a task, merely attempted one, or retained standing access after the task ended. NHI Management Group treats the term as a risk classification, not a product label: if the agent can authenticate, invoke tools, or move data, it should be inventoried, reviewed, and controlled. That framing aligns with the broader governance emphasis in Ultimate Guide to NHIs — 2025 Outlook and Predictions and the agent-specific threat patterns discussed in OWASP NHI Top 10.
For standards-oriented interpretation, the closest external governance lens is the NIST AI Risk Management Framework, which emphasises mapping AI system behaviour to real-world risk rather than assuming safety from design intent alone. The most common misapplication is counting dormant or uncredentialed agents as working agents, which occurs when teams rely on inventory labels instead of observed execution evidence.
Examples and Use Cases
Implementing working-agent classification rigorously often introduces monitoring and review overhead, requiring organisations to weigh faster automation against the cost of continuous visibility and access control.
- An incident-response assistant that can open tickets, query logs, and trigger containment actions is a working agent the moment those tool calls occur, even if it was originally deployed as a pilot.
- A code-generation agent that has been granted a repository token and can merge pull requests must be treated as an active NHI, especially if it is described in the same way as a human developer in IAM records.
- A customer-support agent that sends emails through a production mailbox and accesses CRM data becomes operationally relevant, because its credential use creates audit and revocation obligations.
- An orchestration bot that still holds secrets after a project is paused remains in scope if it can resume execution without re-approval, a pattern highlighted in the Moltbook AI agent keys breach.
- Agent behaviour should also be evaluated against the OWASP Top 10 for Agentic Applications 2026, because tool abuse and excessive autonomy often begin with a system that looked harmless on paper.
In practice, a working agent is usually discovered through logs, token issuance, tool telemetry, or side effects in connected systems, not through architecture diagrams alone. That is why visibility into actual execution is the deciding factor.
Why It Matters in NHI Security
Working status is the difference between theoretical exposure and active attack surface. If an agent has not executed, it may still warrant review; if it has executed, it can already have permissions, data access, and residual tokens that must be governed as live identity assets. That distinction is critical because NHI risk is rarely limited to creation time. It accumulates during runtime, especially when credentials remain valid after the task is complete or when ownership is unclear.
NHI Mgmt Group reports that 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage. Working agents contribute directly to that exposure when their credentials are not rotated, scoped, or retired after use. The same operational reality appears in agent-centric breach reporting, including CoPhish OAuth Token Theft via Copilot Studio and Replit AI Tool Database Deletion, where real execution created real consequences.
Practitioners should also map working agents to NIST AI Risk Management Framework and the CSA MAESTRO agentic AI threat modeling framework so that telemetry, authorization, and rollback expectations are explicit. Organisations typically encounter the need to classify working agents only after a token leak, misuse event, or unexplained action reveals that an “inactive” agent was operationally live.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Working agents become governed NHIs once they can authenticate and act. |
| OWASP Agentic AI Top 10 | A2 | Agentic systems create risk when tool-using agents operate with live access. |
| NIST AI RMF | AI RMF centers risk management around observed AI behavior and impact. | |
| NIST CSF 2.0 | PR.AA | Active agents require identity, authentication, and access governance. |
| NIST Zero Trust (SP 800-207) | SP 800-207 | Zero Trust requires continuous verification of every active requester. |
Inventory active agents, bind them to owners, and revoke access when execution ends.
