Agentic AI resilience depends on identity, memory and workflow trust

At a glance

What this is: This is Commvault's analysis of why agentic AI resilience fails when teams treat autonomous systems like ordinary applications, and why memory, workflows, observability, and trust relationships must be recovered together.

Why it matters: IAM, IGA, PAM, and NHI teams need this because agentic systems turn identity, access, and operational state into part of the recovery problem, not just the access-control problem.

By the numbers:

• Only 17% of organisations continuously monitor agent-to-agent interactions, leaving most multi-agent deployments partially blind to the trust relationships that shape outcomes.
• Only 1 in 5 companies has a mature model for governing autonomous AI agents, showing that readiness is trailing adoption.

Context

Agentic AI resilience is not the same as application recovery. These systems keep memory, execute dynamically at runtime, and pass context across agent boundaries, so a clean backup can restore data while leaving the underlying trust state unresolved.

For identity and access teams, the governance gap is that the system's behaviour depends on memory stores, workflow decisions, and inter-agent trust relationships that conventional IAM, logging, and disaster recovery models do not fully capture.

Commvault's analysis treats this as a state-and-coherence problem, not a simple availability problem. That framing is increasingly typical of how mature security teams should assess autonomous AI environments.

Key questions

Q: How should security teams govern recovery for agentic AI systems?

A: They should define recovery around a verified state across memory, workflows, identities, and agent interactions, not around restoring data alone. If any layer comes back without proof that it matches the others, the system may be operational but still untrustworthy. Recovery needs coherence checks before the environment is returned to service.

Q: Why do conversational AI systems create new identity and access risks?

A: Because they can combine data retrieval, decision-making, and execution in a single interaction. That collapses the gap between information access and business action, which traditional IAM and security tools were not built to manage. The result is higher exposure when the system can modify records or disclose sensitive guest data.

Q: What breaks when agent-to-agent interactions are not fully observable?

A: The causal chain breaks. You may still see isolated tool calls, but you lose the context handoffs, delegated outputs, and trust relationships that explain why the system behaved as it did. That makes incident response, accountability, and recovery reconstruction incomplete.

Q: What should organisations do before trusting a multi-agent workflow?

A: They should verify that planning inputs, context transfers, and downstream outputs still form a consistent chain of custody. A workflow that appears successful can still be compromised if one agent received manipulated context and passed it on authoritatively. Trust should be proven at the interaction layer, not assumed from the final output.

Technical breakdown

Why agent memory is a security boundary

Agent memory is the persistent context layer that lets an AI system remember prior interactions, retrieved documents, and intermediate state across sessions. In practice this often means vector databases, session state, and cached context. If an attacker can influence that layer, they do not need to compromise the model itself. They can change what the agent treats as authoritative, redirecting decisions through seemingly normal outputs. Traditional anomaly tools struggle here because embedding space behaves differently from structured logs or records. The key technical point is that memory is not passive storage. It is part of the decision surface, which means integrity has to be verified as rigorously as access credentials.

Practical implication: treat memory stores as governed control points and verify their integrity before trusting any recovered agent state.

How runtime workflows become the attack path

Agentic workflows are constructed at runtime. The agent receives a goal, selects steps, chooses tools, and may spawn subagents to complete the task. That makes the workflow adaptive, but it also means a corrupted prompt, poisoned tool response, or manipulated planning input can steer the whole sequence while every individual tool call still looks authorised. Conventional automation assumes a bounded script with a predictable end state. Agentic execution does not. The security issue is not just malicious output. It is that the workflow itself can be the vehicle for compromise, especially when execution runs continuously and the gap between compromise and detection stretches across many decisions.

Practical implication: monitor decisions and planning inputs, not just tool execution logs, when you assess agentic workflow risk.

Why agent-to-agent trust breaks conventional observability

Multi-agent systems add a trust layer that standard observability tools were not designed to reconstruct. One agent passes context to another, subagents return partial results, and orchestrators act on those outputs as if they were verified facts. If a downstream agent inherits corrupted context, the failure can propagate without a clear signal at any single point. That is why the article's focus on agent-to-agent interactions matters. Security teams can log individual actions and still miss the interaction layer where the most consequential failures emerge. The real gap is not volume of telemetry. It is whether the telemetry preserves the sequence and trust relationships needed to prove what actually happened.

Practical implication: build observability for context handoffs and agent relationships, not only for isolated agent events.

Threat narrative

Attacker objective: The attacker wants the agentic system to make authorised-looking but incorrect decisions that advance the attacker’s goals while avoiding conventional detection.

1. Entry begins when an attacker influences the memory layer, runtime planning input, or a tool response that an agent trusts as authoritative.
2. Escalation occurs as the agent acts on corrupted context using legitimate tools and access, while subagents or orchestrators propagate the tainted state.
3. Impact follows when the compromised workflow produces incorrect decisions across connected systems, creating a difficult-to-reverse trust failure across the agent stack.

Breaches seen in the wild

• tj-actions/changed-files compromise 2025: A stolen bot token let attackers poison tj-actions/changed-files so pipelines printed their CI/CD secrets to public logs (CVE-2025-30066).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic resilience is a coherence problem, not a restore problem: clean backup logic assumes stateless systems, but agentic AI carries memory, workflow state, and trust relationships that must align at the same moment. A restored model can still be untrustworthy if the memory layer or orchestration state is stale or manipulated. The practitioner implication is that recovery has to validate relational state, not just recover artefacts.

Access review assumptions collapse when identity participates in runtime decision-making: access review was designed for privileges that persist long enough to be observed, certified, and revoked. That assumption fails when an agent acquires, uses, and propagates access inside continuous execution loops. The implication is not simply more review cadence. It is that the control premise itself no longer holds for autonomous behaviour.

Agent-to-agent trust is becoming an identity problem, not only an observability problem: once one agent can supply context that another agent treats as authoritative, trust boundaries shift from the model boundary to the interaction boundary. Traditional logging can confirm that calls occurred, but not whether the transferred context was trustworthy. Practitioners should treat inter-agent trust as a first-class governance issue across NHI and agentic AI programmes.

We need a named concept for the new failure mode: coherence debt: the gap between what each layer knows and what the system can prove about their shared state. Memory stores, orchestration layers, and identity systems may each be correct in isolation while still describing different realities. That is why recovery and governance must converge on a single time-aligned record of state.

Agentic AI governance now depends on layered trust verification: the article shows that model output is only one control point in a much larger system. Security leaders need to think in terms of context integrity, workflow integrity, and relationship integrity as separate governance domains. The practitioner conclusion is that autonomous systems require identity controls that verify behaviour across layers, not just credentials at login.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Agentic AI Identity Maturity Model

What this signals

Agentic AI resilience now depends on proving that memory, workflow state, and identity all describe the same moment in time. When those layers drift, restoration can recreate the system without restoring trust, which means recovery design has to move from backups to coherence.

Coherence debt: the practical problem is not that agentic systems lack data. It is that each layer can be correct in isolation while the system as a whole remains unverifiable. That shifts governance toward time-aligned state records, interaction-level visibility, and recovery criteria that can be audited across agents.

The 17% figure matters because it shows how much of the multi-agent interaction layer still sits outside continuous monitoring. For IAM and NHI teams, that is a warning that trust boundaries are expanding faster than the controls built to observe them.

For practitioners

• Map the recovery boundary around system coherence Define recovery success as a verified, time-aligned state across memory, orchestration, identity, and observability layers. If those layers cannot be proven consistent, treat the environment as untrusted even if the model or data store was restored cleanly.
• Inventory and govern agent memory stores Classify vector databases, session state, and retrieved context as security-sensitive assets with integrity monitoring, version history, and provenance controls. The question is not only what was stored, but whether the stored context can be trusted after change.
• Instrument runtime decision paths Capture planning inputs, tool selection, and subagent handoffs so you can reconstruct why an agent acted, not just what it called. Prioritise controls that detect manipulated workflow inputs before those inputs become authorised actions.
• Treat inter-agent trust as a governance object Assign ownership for agent-to-agent context transfers, approved trust boundaries, and escalation paths when one agent depends on another. If a subagent can poison an orchestrator's next decision, the boundary needs explicit review and revocation logic.

Key takeaways

• Agentic AI systems can remain compromised after a restore if memory, workflow, and identity state are not verified together.
• The hardest risk is not model failure alone. It is the mismatch between agent memory, runtime decisions, and inter-agent trust.
• Security teams need recovery and governance models that prove coherence across layers before an autonomous system is treated as trustworthy again.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Memory Layer: The persistent context store that allows an agent to remember prior interactions, retrieved data, and intermediate state across sessions. In agentic AI, this layer influences decisions, so integrity and provenance matter as much as availability.
• Identity Handoff: The controlled transfer of access from one user to the next on a shared device or application session. In manufacturing, the handoff must close the prior session, preserve auditability, and prevent residual access from carrying into the next operator’s activity.
• Coherence State: The condition where memory, workflow, identity, and observability layers all describe the same operational reality at the same time. In agentic AI, recovery is only trustworthy when coherence state can be verified, not merely when data has been restored.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.