A runtime profile of normal tool use, destinations, and state changes for one specific agent deployment. It allows security teams to distinguish expected behaviour from coercion or drift, and it becomes the basis for moving from audit mode to enforced controls.
Expanded Definition
A per-agent baseline is a security profile built for one specific autonomous agent deployment, not for an entire platform or fleet. It captures the agent’s expected tools, API destinations, prompt and workflow patterns, state transitions, and timing so that deviations can be detected with context. In agentic AI environments, this matters because two agents using the same model can still have very different authority, data access, and operational risk. The baseline is therefore closer to an execution profile than a generic policy document, and it often becomes the reference point for alerting, throttling, or control enforcement. NHI Management Group treats this as a practical governance construct aligned to NIST AI Risk Management Framework concepts of mapping, measurement, and ongoing monitoring. Definitions vary across vendors on whether the baseline is learned automatically, curated manually, or blended with policy constraints, so implementations should be read carefully. The most common misapplication is treating a fleet-wide model policy as a per-agent baseline, which occurs when organisations assume identical tool permissions and behavioural norms across deployments that actually serve different business functions.
Examples and Use Cases
Implementing per-agent baselines rigorously often introduces monitoring and tuning overhead, requiring organisations to weigh behavioural precision against operational complexity.
- A customer-support agent is baselined to query a ticketing system and a knowledge base, but not finance systems, so a new payment API call becomes a high-confidence anomaly.
- An engineering agent is allowed to open code repositories, create pull requests, and run tests, while a procurement agent with the same foundation model must never touch source control.
- A research agent normally retrieves documents from approved internal indexes; repeated attempts to reach unsanctioned external destinations indicate possible coercion, prompt injection, or workflow drift, consistent with risks described in the OWASP Agentic AI Top 10.
- A security operations agent may be permitted to read alerts and draft containment actions, but its baseline excludes direct execution of destructive commands until a human approves escalation.
- During red-team exercises, defenders compare live tool use against the baseline to determine whether the agent was merely unusually active or had been pushed into unsafe state changes.
Why It Matters for Security Teams
Per-agent baselines help security teams separate normal autonomy from abnormal authority, which is essential when an agent can initiate actions, call tools, or move data without a human at every step. They support detection of prompt injection, data exfiltration, tool misuse, and unintended state transitions, all of which are active concerns in agentic systems and are reflected in both the CSA MAESTRO agentic AI threat modeling framework and the MITRE ATLAS adversarial AI threat matrix. For identity security teams, the connection is direct: the baseline becomes a control surface for Non-Human Identity governance, because each agent’s credentials, secrets, and delegated access should match its intended behaviour. It is also a useful bridge between audit mode and enforcement, since teams can observe real behaviour before tightening controls that might disrupt service. Organisational blind spots often appear when a safe-looking agent inherits broader permissions than its task requires, or when a workflow changes after deployment without the baseline being updated. Organisations typically encounter the full impact of per-agent baseline gaps only after an agent makes an unexpected tool call or reaches an unapproved destination, at which point the baseline becomes operationally unavoidable to restore trust and contain the incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO, OWASP Non-Human Identity Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | AI RMF centers on mapping and measuring AI system behavior, including agent baselines. | |
| OWASP Agentic AI Top 10 | OWASP Agentic AI Top 10 covers misuse of agent tools, autonomy, and unsafe actions. | |
| CSA MAESTRO | MAESTRO models agentic threats and control points for autonomous AI systems. | |
| OWASP Non-Human Identity Top 10 | NHI guidance is relevant because each agent baseline governs its identity, secrets, and access. | |
| MITRE ATLAS | ATLAS catalogs adversarial AI techniques that can distort an agent's behavior profile. |
Check baseline drift against known adversarial tactics such as prompt injection and tool manipulation.
