Agent-to-agent risk exposes the governance gap in autonomous AI

At a glance

What this is: This analysis says autonomous and semi-autonomous AI agents create agent-to-agent risk because decisions propagate across systems without sufficient inline governance.

Why it matters: IAM and AI security teams need to govern prompts, delegation and tool use as control points, because traditional after-the-fact monitoring cannot stop compounded agentic actions.

Context

Agentic AI changes the control problem because a single system action can become input to another system action, and the resulting risk can compound across workflows rather than remain inside one application. In practice, that means governance has to move closer to decision time, especially where AI systems can retain context, call tools and influence other agents.

The core gap is not model intelligence but operational permissioning: who or what is allowed to act, with what context, and under which policy. Where organisations already treat service accounts, delegated access and task-scoped access as governance problems, agentic AI extends that same concern into runtime decision chains.

Key questions

Q: What breaks when AI agents are allowed to contain incidents without governance?

A: The response chain becomes difficult to audit and reverse. If the agent can isolate hosts or trigger workflows without clear policy limits, teams may not know why an action happened, who approved it, or how to undo it safely. That creates operational speed with weak accountability.

Q: Why do autonomous AI workflows create more security risk than traditional endpoint activity?

A: Autonomous AI workflows create more risk because a command result may no longer map cleanly to a human action. A single outcome can originate from a person, an AI agent acting on their behalf, a prompt injection, or an automated workflow. Without prompt-to-action attribution, teams lose the context needed to judge whether activity is legitimate or harmful.

Q: What are the signs that AI governance is failing in the enterprise?

A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk. Another indicator is weak visibility into who is using which tools and what data they are sending. If teams cannot answer those questions, governance is not working as intended.

Q: Should organisations treat AI coding agents like privileged software identities?

A: Yes. If an AI agent can install code, access secrets, or modify repositories, it is functionally acting as a privileged non-human identity and should be governed that way. That means task-scoped access, explicit boundaries, and monitoring of its downstream actions, especially when it can touch build and release systems.

Technical breakdown

Why agent-to-agent chains amplify risk

Agentic systems change the mechanics of failure because one agent’s output can become another agent’s input without a human pause. That creates a chain of delegated decisions, persistent context and tool invocation that can spread error, overreach or manipulation across multiple workflows. The risk is not limited to a single bad response. It is the cumulative effect of decisions compounding through orchestration, memory and external actions. In security terms, the control boundary shifts from the application request to the interaction chain itself. See the Agentic AI Security Guide.

Practical implication: Design controls for the whole decision chain, not just the individual prompt or model output.

Prompt-level trust evaluation as an inline control

A prompt is effectively a policy-bearing request in agentic systems because it can influence memory, tool selection and downstream execution. That makes prompt-level evaluation a control point, not just a logging event. Inline evaluation can compare the request, the agent context and the intended action against policy before the system commits to an outcome. This is materially different from retrospective monitoring, which only explains what already happened. The architectural issue is timing: control has to occur while the system is still deciding.

Practical implication: Move trust evaluation to the point where prompts are authorised, not after actions have executed.

Observability does not stop autonomous side effects

Logging, traceability and audit trails still matter, but they are insufficient when an agent can trigger actions before a human sees the event. Observability tells you that a cascade occurred; it does not prevent the cascade. In agentic environments, the more important question is whether an action can be blocked, constrained or redirected before propagation. That requires runtime policy enforcement around tool use, delegation scope and action thresholds, especially where multiple agents share context or responsibilities. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: Pair audit logging with runtime enforcement that can stop unsafe agent actions before they spread.

Threat narrative

Attacker objective: The practical objective is to cause harmful downstream actions or business disruption by exploiting the absence of inline governance in agentic decision chains.

1. Entry occurs when an AI agent receives a prompt or agent-to-agent handoff that carries untested intent into the workflow.
2. Escalation follows when context persists and the agent invokes tools or influences other agents without inline risk evaluation.
3. Impact appears when ungoverned decisions cascade across systems, producing actions that were never explicitly approved by a human.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent-to-agent risk is now a governance problem, not a model-quality problem. The article’s central insight is that failures emerge when one agent’s output becomes another agent’s input without policy checks at the point of transfer. That turns orchestration into a security boundary and makes delegation, approval and context handling the real control plane. Practitioners should govern the interaction chain, not just the model response.

Prompt-level evaluation is the missing control layer for agentic systems. Retrospective monitoring can explain why an action happened, but it cannot stop an agent from taking the next step. Inline controls must evaluate intent, context and downstream effect before tools are invoked or actions are committed. The relevant benchmark is whether the system can constrain risky execution before propagation, not whether it can record the event after the fact.

AI agents now need identity governance, not just access to APIs. Once an agent can retain context, act across workflows and trigger external actions, it functions like an operational identity with scope and lifecycle. That means delegation, privilege boundaries and retirement conditions matter as much as model safeguards. Agentic AI identity becomes a governance requirement, not an architectural nicety. Practitioners should treat each agent as a controlled identity with explicit authority.

Agentic AI increases control-plane fragility because risk compounds across chained decisions. The article correctly highlights that a small error can cascade through multi-agent workflows and create downstream impact no single approval step would have caught. That calls for zero-trust style thinking around every request, every handoff and every tool invocation. Practitioners should assume that unchecked agent interactions will amplify, not average out.

Governance should measure whether autonomous actions are still bounded by policy. The right question is not whether agents are active, but whether their actions remain within real-time policy thresholds as they interact. If an organisation can only reconstruct the chain after the fact, it does not yet have operational control. Practitioners should judge maturity by whether the environment can block, redirect or quarantine unsafe agent behaviour in motion.

From our research library:

• 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
• Read next: AI Agent Authorisation Guide

What this signals

Agentic governance debt: the longer organisations allow agent interactions to expand without inline policy, the more control they lose over delegation, tool use and downstream side effects. The issue is not future AI autonomy in the abstract, but present-day workflows that already let agents make consequential decisions faster than governance can react.

The practical shift for programmes is to measure whether agent actions can still be bounded at runtime. Observability, audit and incident review remain necessary, but they are no longer sufficient when decisions can chain across systems before a human sees the event.

For practitioners

• Define inline approval boundaries for agent actions Require policy evaluation before agents can call tools, hand off tasks or alter shared context. Reserve human approval for actions that cross trust zones, affect sensitive data or trigger external side effects.
• Classify each AI agent as a governed identity Assign every agent an owner, scope, lifecycle state and delegation limit so it can be registered, reviewed and retired like any other privileged operational identity.
• Instrument agent interactions for pre-action controls Collect prompts, context changes, tool requests and agent-to-agent handoffs, then enforce rules at execution time rather than relying only on logs and investigations afterward.
• Separate exploratory agents from production actions Allow experimentation in sandboxes with constrained tools and no standing access to production systems, data stores or customer-facing workflows.

Key takeaways

• Agentic AI creates a governance gap because chained decisions can propagate risk across systems without a human checkpoint at each step.
• The key control failure is not model intelligence but the absence of inline policy enforcement at prompt and handoff time.
• Practitioners should govern agent identity, delegation and execution scope as runtime controls, not as after-the-fact audit topics.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · Agentic AI Identity Guide · AI Agent Observability, Audit and Incident Response Guide · Zero Trust for AI Agents

Key terms

• Agent-to-agent trust: The rules that determine whether one AI agent can authenticate, delegate, or share context with another. This is an identity problem as much as an integration problem, because uncontrolled trust propagation can create hidden access paths and make accountability harder to prove.
• Inline Governance: Governance enforced in the runtime path rather than after the fact. For AI systems, that means tool access, rate limits, guardrails, and identity checks are applied before action occurs, not only during later review or investigation.
• Prompt-level trust evaluation: A control approach that assesses the trustworthiness of a prompt in context, including intent, surrounding state and likely downstream effects. It is designed for agentic systems where the prompt can directly influence memory, tool selection and execution.
• Operational Identity Contact: An operational identity contact is the person or team responsible for receiving and acting on identity administration signals such as SSO setup, directory sync, or certificate renewal. It is not just metadata. It is part of the control plane because it determines who can respond when identity operations need intervention.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps security practitioners turn identity and access principles into controls that work across modern AI and infrastructure programmes.