TL;DR: AI agents call APIs, trigger workflows, and modify systems after the model layer, leaving most security tooling blind to the actions that create real risk, according to Salt. The action layer, not prompt security alone, is where agentic governance becomes operationally necessary.
At a glance
What this is: Salt argues that the real security problem for AI agents sits in the action layer, where agent decisions become API calls, workflows, and system changes.
Why it matters: This matters because IAM, PAM, and AI governance teams need to control what agents can do at runtime, not just what the model is allowed to say.
Context
Action layer security describes the controls that govern what an AI agent can do after it has reasoned about a task. In this article, the security gap is not prompt abuse but the lack of visibility into the APIs, workflows, databases, and third-party services that agents can reach once they begin acting.
That gap matters because agentic systems blur the boundary between AI governance and identity governance. Once an agent can invoke tools, submit payloads, and chain actions across systems, access control, runtime monitoring, and delegated authority become part of the same control problem. The article is about that missing operational layer, not about model safety in isolation.
Key questions
Q: What breaks when AI agent behaviour is only monitored at the prompt layer?
A: Prompt-layer monitoring misses the point where risk becomes real, which is tool use, data movement, and chained actions inside the session. If the agent can move from request to execution without fresh control checks, the organisation sees intent but not impact until it is too late.
Q: Why do AI agents increase IAM and PAM risk?
A: AI agents increase IAM and PAM risk because they can execute actions quickly once privilege is available, which shortens the time available to detect misuse. If access is always on, the attack surface is always on too. That is why task-scoped privilege and ownership controls matter.
Q: What are the signs that agentic security testing is failing?
A: Common failure signs include inflated finding volumes, repeated false positives, opaque reasoning, results that cannot be reproduced, and test actions that drift beyond approved scope. Another warning sign is when analysts must manually clean up too many outputs before anyone can trust them for remediation decisions.
Q: How should teams decide between API governance and MCP governance for agents?
A: Use API governance for the backend service boundary and MCP governance for the agent-facing tool boundary. The two overlap, but they solve different problems: one secures the service surface, the other constrains how agents discover and consume that surface.
Technical breakdown
What the action layer is in agentic systems
The action layer is the point at which an AI agent stops reasoning and starts doing. The model produces intent, but the surrounding orchestration then converts that intent into API calls, workflow triggers, database writes, email actions, or transactions. In practice, this layer includes MCP servers, downstream APIs, and the service paths that connect an agent to enterprise systems. Model-layer controls can inspect prompts and outputs, but they cannot see whether an action is unusual, over-scoped, or chained across multiple systems. That is why runtime governance must shift from language inspection to execution oversight.
Practical implication: Track the systems an agent can actually reach and govern those execution paths as first-class access.
Why prompt security does not cover agent behaviour
Prompt filters and jailbreak detection are designed to defend conversations, not infrastructure. An agent can pass a prompt check and still perform a harmful action if it has legitimate tool access. The security failure mode is therefore not only malicious input but authorized misuse of legitimate access. In agentic environments, the risk often appears as an ordinary API call with an unusual frequency, payload, or sequence. That makes action-level telemetry essential. Without it, defenders see the conversation but miss the execution pattern that produces data exposure, workflow abuse, or operational disruption.
Practical implication: Treat prompt controls as necessary but incomplete, and instrument the tool calls that follow them.
How MCP changes the governance problem
MCP servers act as the bridge between the agent and the enterprise environment. They make tools discoverable and usable, but they also create a governance surface that looks more like delegated infrastructure access than a simple chat interface. If an agent can reach an MCP server, it can often inherit the server’s downstream permissions and touch many more services than the original prompt implied. That makes inventory, authorization, and behavioural baselining central controls. The challenge is not just whether the agent is permitted to act, but whether the connected action path is known, bounded, and monitored.
Practical implication: Map MCP-connected systems, then verify that each one has explicit runtime authorization and monitoring.
Threat narrative
Attacker objective: The objective is to turn legitimate agent access into real-world system impact while staying invisible to prompt-layer controls.
- Entry occurs when an agent is allowed to interact with enterprise systems through MCP servers and APIs that are not fully visible to security teams.
- Credential or authorisation abuse happens when the agent uses legitimate access to call an API it has never used before or to chain benign actions into a harmful sequence.
- Impact follows when those runtime actions exfiltrate sensitive data, modify production systems, or move laterally through connected services without model-layer detection.
Breaches seen in the wild
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
- 12,000 secrets in LLM training data: Truffle Security found 11,908 live API keys and passwords hard-coded in web pages captured by Common Crawl, a dataset used to train LLMs.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Action layer security is now the missing control plane for agentic governance. The article is right to separate model safety from execution safety, because the real risk emerges when a delegated system can act across APIs and workflows. That shifts the governance question from what the model said to what the agent was allowed to do in the environment. Practitioners should treat action visibility as a core identity and access control requirement, not a monitoring nice-to-have.
Agent behaviour cannot be governed from the prompt alone. Prompt-layer controls observe text, but agentic compromise often looks like ordinary access executed at the wrong time, in the wrong sequence, or against the wrong endpoint. That is why runtime authorization, behavioural baselining, and action telemetry matter more than conversation scanning once agents can touch production systems. Security teams need controls that evaluate the action, not just the instruction.
Delegated tool access turns AI governance into an IAM and PAM problem. When an agent inherits permissions through connected services, the governance failure is not just model misuse but excessive delegated authority. The control gap is a trust model that assumes tool access is safe because the request originated from a model. Practitioners should re-evaluate how AI systems receive, hold, and exercise privilege across the full action path.
Shadow MCP exposure creates a new discovery problem for security teams. If agents can connect to unregistered servers or unmanaged endpoints, the attack surface expands faster than policy inventories. This is not only an AI issue but also a lifecycle and governance issue for machine identities and service integrations. Teams should assume that any invisible action path is a potential control gap until it is explicitly inventoried and monitored.
API security becomes the enforcement layer for agentic systems. The article’s core message is that the action layer is where AI decisions become loss, and that means API governance now carries more weight in agentic risk management. Access scope, payload patterns, and runtime monitoring are no longer just application concerns. They are the practical boundary between a useful agent and an uncontrolled one.
From our research library:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
Action layer governance is where agentic AI will separate mature programmes from experimental ones. Security teams already know how to review model outputs, but they are less prepared to govern tool execution, inherited permissions, and chained system actions. The control shift is from content inspection to runtime authority, which places identity, access, and monitoring closer to the core of AI risk management.
API security now carries agentic meaning, not just application meaning. If an agent can call production systems through ordinary interfaces, then API posture becomes a governance issue for AI as much as for applications. The operational question is no longer whether the model behaves safely in conversation, but whether the runtime path is bounded, observable, and attributable.
For practitioners
- Inventory all agent action paths Identify every API, workflow engine, database, and third-party service an agent can reach, including MCP-connected and shadow deployments. Compare the discovered paths with what your teams believe is in scope, then remove or isolate anything that lacks a named owner or documented purpose.
- Baseline normal agent behaviour Define what normal looks like for each agent by frequency, endpoint, payload shape, and task context. Use those baselines to spot unusual action sequences, not just unusual prompts, because the dangerous behaviour often appears only at execution time.
- Apply runtime authorization to tool use Require explicit authorization checks for agent actions that write data, move money, modify systems, or chain across services. Treat inherited permissions as risk-bearing until the runtime decision has been validated against policy.
- Monitor the full runtime path Correlate agent activity across Kubernetes, gateways, load balancers, legacy systems, and cloud services so the action history is visible end to end. Conversation logs alone will not show whether the agent reached a sensitive endpoint or executed a harmful sequence.
Key takeaways
- The central risk in agentic AI is not prompt misuse alone but the ability of an authorised agent to take harmful actions through APIs, workflows, and downstream systems.
- That risk is amplified when action paths are invisible, because prompt-layer tools cannot see unusual calls, chained execution, or delegated access abuse.
- Security teams need runtime authorization, behavioural baselining, and action-layer telemetry to govern agents where decisions become real system changes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | Agent actions that trigger workflows and move money map directly to sensitive business flow abuse. |
| Recommendation — Restrict and monitor agent access to sensitive business flows before they can execute high-impact actions. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on delegated agent privilege and how it can be misused at runtime. |
| Recommendation — Constrain agent privileges and verify each tool request against policy at execution time. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The governance gap is excessive or invisible runtime permissioning for agent actions. |
| Recommendation — Continuously review and enforce agent entitlements so runtime access stays bounded to approved actions. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes how agent access can be abused to reach new systems and move across connected services. |
| Recommendation — Map agent tool abuse to credential access and lateral movement tactics in your detection content. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about governing AI systems that can act in production environments. |
| Recommendation — Define accountability for agent actions and bind it to runtime controls across the AI stack. | ||
Key terms
- Action Layer: The action layer is the point where an identity moves from asking for access to doing something with that access. For AI agents, this layer matters because tool use can happen faster than human review, and the meaningful risk appears when actions are chained across systems.
- MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
- Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
- Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners connect delegated access, runtime authority, and lifecycle control to the wider identity programme.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org