TL;DR: The Great Agent Hack 2025 showed that observability, multi-agent coordination, and systematic red-teaming are becoming the practical baseline for production agentic AI, according to Holistic AI. The lesson is that governance must move from supervising a model in isolation to controlling the behaviour, traces, and failure modes of interacting agent systems.
At a glance
What this is: This is an analysis of what the Great Agent Hack 2025 revealed about agentic AI governance: observability, multi-agent coordination, and system-level red-teaming are becoming the operational baseline.
Why it matters: It matters because AI governance teams, IAM leads, and security architects need to govern agent behaviour, tool use, and traceability as a system problem, not just a model-risk problem.
Context
Agentic AI governance fails when teams treat a single model as the control boundary. Once agents plan, call tools, exchange context, and hand work between components, the relevant risk shifts to the whole execution path, including traces, permissions, and failure propagation.
The Great Agent Hack 2025 is a useful signal because it tested agentic systems under performance, observability, and safety pressures rather than in abstract demos. That makes the findings relevant to organisations building AI programmes where governance, auditability, and operational control have to survive real-world complexity.
Key questions
Q: How should security teams govern agentic AI as it moves into production?
A: Security teams should govern agentic AI as a class of non-human identity, not as a generic application feature. That means assigning ownership, scoping permissions tightly, logging every tool action, and revoking access on a defined lifecycle. Production rollout should require clear approval points for high-risk actions and continuous monitoring for drift.
Q: Why do agentic AI systems need human-in-the-loop controls?
A: Human-in-the-loop controls keep high-risk decisions inside a review path while allowing automation to handle routine work. That matters because autonomous systems can act quickly, but speed does not remove the need for accountability. Review gates, override rights, and escalation paths reduce the chance that a model error becomes a privilege incident.
Q: How do you know whether agent observability is enough?
A: Observability is enough only when the organisation already has real-time policy enforcement at the tool layer. If logs and alerts are the main defence, the session can complete harmful actions before anyone responds. In agentic systems, visibility supports investigation, but enforcement prevents misuse.
Q: What should organisations test before adopting agentic AI in security operations?
A: Organisations should test whether the agent can act safely under failure, whether its actions are traceable, and whether an incorrect decision can be rolled back. The key question is not only what the agent can do, but what happens when upstream telemetry is wrong or incomplete. Without that test, automation can spread error faster than humans can correct it.
Technical breakdown
Why system-level observability is now the control layer
AI observability goes beyond infrastructure monitoring. In agentic systems it must capture prompts, outputs, tool calls, latency, costs, trace chains, and intermediate reasoning so operators can see how the system arrived at a result. The article shows teams converging on dashboards, workflow visualisations, and step-level introspection because the failure surface is distributed across data, model, and orchestration. Without that end-to-end view, drift and bad behaviour appear only after they affect customers or operations.
Practical implication: instrument agent workflows at the trace level before broad production rollout.
How multi-agent workflows change governance assumptions
Multi-agent systems distribute work across specialised components that plan, review, verify, and execute. That improves task decomposition, but it also creates new governance questions because control is no longer local to one model instance. Decisions can be shaped by upstream agents, hidden dependencies, and handoff errors between steps. Governance therefore has to track the flow of authority across the system, not just the state of the final output. This is where agent identity, tool permissions, and delegation boundaries intersect with AI governance.
Practical implication: define who or what each agent may delegate to, and bound cross-agent authority explicitly.
Why system red-teaming matters more than prompt testing
The article shows a shift from ad hoc prompt experiments to structured stress testing that probes an agent under realistic pressure. That matters because agentic failures often emerge only when the full system is exercised, including memory, tools, and multi-step planning. Red-teaming at the system level can expose brittle coordination, unsafe tool invocation, and behaviour that looks acceptable in isolation but fails in sequence. For governance teams, the question is no longer whether a model answers well in a sandbox; it is whether the assembled system remains bounded when conditions change.
Practical implication: test the complete agent workflow under adversarial and edge-case conditions, not just the model prompt.
NHI Mgmt Group analysis
System control is the new governance boundary for agentic AI. The article’s central lesson is that supervising a model in isolation is no longer enough once agents interact, call tools, and pass work between steps. Governance has to move to execution traces, delegation paths, and system behaviour because the risk emerges from composition, not just model output. Practitioner conclusion: design controls for the workflow, not the prompt.
Agent identity is becoming a governance problem, not just an access problem. When multiple agents can plan and execute across shared tools, the security question is who or what is authorised to act at each stage. That creates a direct bridge to identity governance because permissions, authentication, and delegated authority now shape AI behaviour. Practitioner conclusion: treat agent permissions as a governed identity surface.
Observability is turning into a compliance and accountability requirement. The article ties logs, traces, explanations, and behavioural visibility to safe deployment, which means auditability is no longer optional once agents influence decisions or operations. That aligns with NIST AI RMF expectations around mapping, measuring, and managing AI risk. Practitioner conclusion: require traceability evidence before scaling agentic workflows.
Red-teaming is shifting from a validation exercise to an operating control. The winning projects emphasised repeatable probing, behavioural stress tests, and structured evaluation, which is what production teams will need once agents are embedded in business workflows. The field is moving toward continuous assurance rather than one-time approval. Practitioner conclusion: make system-level testing part of the release gate, not a post-launch activity.
Agentic AI governance debt will accumulate wherever teams can deploy faster than they can observe. Smaller models, larger models, and multi-agent orchestration can all work well, but each added layer raises the cost of unmanaged behaviour if governance lags behind. This is especially true in environments that scale quickly across business units. Practitioner conclusion: grow oversight in step with deployment, or the control gap will widen faster than model capability.
From our research library:
- 63% of organisations surveyed lacked AI governance policies to manage AI or prevent shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Agentic AI governance will increasingly be decided at the workflow level. The practical control boundary is shifting from the model response to the sequence of actions that produces it, which means teams need to govern delegation, tool use, and traceability together. Observability debt is the term to watch here: if you cannot reconstruct agent behaviour, you cannot defend it.
Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey. That gap suggests governance is lagging deployment, not the other way around.
Enterprises should expect auditability and agent permissioning to become procurement and architecture questions, not afterthoughts. The organisations that can demonstrate traceable agent behaviour, bounded authority, and repeatable testing will be better placed to scale agentic systems with less operational drift.
For practitioners
- Define system-level governance boundaries for agents Map each agent workflow to an explicit control boundary covering tool access, delegation limits, and escalation paths. Do not rely on the model layer alone to define what the system is allowed to do.
- Instrument end-to-end observability for every agent workflow Capture prompts, responses, tool calls, latency, cost, and intermediate steps so you can reconstruct how a decision was made. Use those traces for audit, troubleshooting, and containment decisions.
- Separate model selection from governance design Allow smaller and larger models to coexist only after you have defined the same oversight standard for each workflow, including approval thresholds and monitoring expectations.
- Build continuous red-teaming into release governance Test coordinated agents under adversarial prompts, tool abuse, and edge-case sequencing before production release and after major workflow changes.
Key takeaways
- The article shows that agentic AI governance is moving away from isolated model supervision and toward control of the full execution system, including handoffs, traces, and tool use.
- Multi-agent workflows create new governance pressure because authority can be distributed across planning, review, verification, and execution steps.
- Continuous system-level red-teaming and observability are becoming the practical controls that make agentic AI auditable and safer to deploy.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on governing what agents can do and who they can act as. |
| ASI07 — Insecure Inter-Agent Communication | Multi-agent coordination and handoffs are core to the article's governance concern. | |
| ASI08 — Cascading Failures | The article stresses how failures emerge through system interaction rather than isolated model output. | |
| Recommendation — Bound agent authority explicitly and review privilege paths that let agents act beyond intended scope. Harden inter-agent handoffs and validate that messages and decisions cannot be altered in transit. Test agent workflows for chained failure conditions before allowing them into production. | ||
| NIST AI RMF | MEASURE — AI Measurement and Monitoring | Observability, traceability, and repeatable testing are the article's core governance themes. |
| MANAGE — AI Risk Management | The post frames production governance as system control and risk containment. | |
| Recommendation — Use MEASURE to require traceable evidence for agent behaviour and ongoing monitoring. Use MANAGE to set approval gates, escalation paths, and lifecycle controls for agentic workflows. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | The article repeatedly ties governance to logs, traces, and accountability evidence. |
| Recommendation — Review audit records for agent actions and correlate traces with workflow outcomes. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- AI observability: AI observability is the ability to see how AI systems are being used, what information they process, and what actions they trigger. In security programmes, it extends beyond uptime or model quality to runtime visibility, policy enforcement, and audit evidence across human and agent-driven use cases.
- Multi-Agent Workflow: A multi-agent workflow is a system where several AI agents or models pass outputs to one another to complete a task. Each step can introduce new assumptions, errors, or policy drift, which makes accountability and failure analysis more difficult than in a single-model design.
- System-Level Red-Teaming: A structured testing approach that exercises the full AI system under adversarial, edge-case, and failure-inducing conditions. It looks for behaviour that only appears when memory, tools, orchestration, and agent interactions are combined in realistic sequences.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. If your programme is dealing with delegated AI behaviour, the course helps connect governance, identity, and operational control.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org