Agentic AI risk is defined by irreversible tool actions, not outputs

At a glance

What this is: This analysis says agentic AI risk is defined by irreversible actions, not just model outputs, because agents can write, call, and modify state in ways that cannot be rolled back.

Why it matters: IAM, PAM, NHI, and AI security teams need to control delegated action before execution, because post hoc review cannot contain a tool call, permission abuse, or state change.

By the numbers:

• Only about one-third of ~500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
• Openlayer blocks tool calls outside a registered allowlist before execution, suspends agent sessions when intent-to-tool alignment drops below 0.75, and tracks drift across 13 session-level metrics.

Context

Agentic AI changes the security problem because the system is no longer limited to generating text. Once an agent can call tools, write to databases, or trigger workflows, the control question becomes whether the action should be allowed at all, not whether the output looks acceptable.

That is where the identity and governance angle becomes real. An agent with delegated authority behaves like a non-human identity with runtime permissions, so governance has to cover scope, reversibility, and enforcement before execution rather than relying on output review after the fact.

The article also reflects a typical enterprise gap rather than an edge case. Many teams are still treating agentic deployments as an evaluation problem, when the underlying risk is actually an authorisation and control problem.

Key questions

Q: What breaks when agentic code assistants are allowed to act without runtime controls?

A: The main failure is that static review cannot stop live misuse. A model may pass code analysis and still be manipulated at runtime into reading sensitive files, invoking the wrong tool, or pushing changes into deployment flows. Without execution-time controls, the agent's authority becomes the attack surface.

Q: Why do irreversible tool actions create a bigger governance problem than model hallucinations?

A: Hallucinations are usually recoverable because they remain outputs. Tool actions, database writes, and API calls change real state, so the issue becomes authorisation and containment rather than content accuracy. That is why agentic governance has to focus on delegated action, not only on whether the model produced a plausible response.

Q: How do security teams know if agentic AI controls are failing?

A: The main signs are session drift, repeated retry loops, unauthorized tool calls, and behaviour that diverges from the documented task sequence. If the agent keeps moving through steps after intent-to-tool alignment weakens, the system is drifting beyond its control envelope. In practice, teams should measure the full execution path, not isolated prompts.

Q: Why do agentic AI systems increase the need for layered identity and access controls?

A: Agentic systems can plan, call tools, retain memory, and act with minimal supervision, so a single weak control can cascade into broader compromise. Identity and access controls must limit what an agent can see, decide, and execute at each layer. Without that, prompt abuse, context poisoning, and tool misuse can turn into real operational impact.

Technical breakdown

Why irreversible tool actions change the risk model

Traditional AI evaluation assumes the model’s effect ends at the response boundary. Agentic systems cross that boundary by invoking tools, writing to data stores, and triggering downstream workflows, which turns a bad decision into a real system state change. The key technical distinction is reversibility: outputs can be suppressed, but an executed API call or database write cannot be unmade. That means the security control point moves from response quality to action authorisation, and the relevant failure mode becomes delegated misuse rather than model error.

Practical implication: Treat tool execution as a privileged action path, not an inference output, and gate it before the call occurs.

How runtime enforcement differs from logging and review

Logging records evidence after the fact, while runtime enforcement prevents an action from crossing into production state. For agentic AI, that difference matters because the harm window can be milliseconds long and the consequence may already be downstream by the time a log is written. Allow lists, session suspension, and intent-to-tool alignment checks are enforcement mechanisms because they operate before execution. This is also where NHI governance and PAM thinking intersect with AI systems: permissions are not just assigned, they must be continuously constrained while the agent is running.

Practical implication: Place policy decisions in the execution path so the system can block, suspend, or redirect before a tool call completes.

Why multi-step agent workflows create compound attack surfaces

An agent does not need one large permission to become dangerous; it only needs enough smaller permissions that combine into a harmful chain. Read access to one system, write access to another, and a connection to a retrieval source can create a path no single permission review would predict. Multi-turn sessions, sub-agents, and tool chains amplify that problem because each step can inherit trust from the last. The technical issue is not just misconfiguration, but the compounding of authority across an execution graph that static model testing never fully exercises.

Practical implication: Map the full permission chain across tools and sessions, then test the combined path rather than each permission in isolation.

Threat narrative

Attacker objective: To use the agent's delegated authority to execute an unauthorised action that alters real systems or data before defenders can intervene.

1. Entry occurs when a prompt injection or manipulated input persuades the agent to follow an unauthorised tool path instead of its intended task.
2. Credential or authority abuse follows when the agent uses delegated permissions to call tools, write records, or reach systems outside the intended scope.
3. Impact occurs when the irreversible action has already changed production state, leaving logging and review too late to contain the outcome.

Breaches seen in the wild

• Microsoft SAS token exposure 2023: An over-permissive Azure SAS token in a Microsoft AI GitHub repo exposed 38TB, including workstation backups and Teams messages, for 3 years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Irreversibility is the defining governance gap in agentic AI. The central mistake is treating agent evaluation as though the main risk were bad text generation. Once an agent can write to systems or trigger workflows, the governance problem becomes action containment before execution, not output quality after the fact. Practitioners should stop measuring only what the model said and start governing what the system is allowed to do.

Agentic AI is already behaving like a non-human identity problem. The agent is not just a model, it is a runtime principal with delegated authority, tool access, and session continuity. That makes NHI governance, PAM controls, and runtime authorisation inseparable from AI safety discussions. Teams that do not model the agent as an identity-bearing actor will miss the real control boundary.

Scope bounding is more important than model scoring for production readiness. A well-scored agent can still be unsafe if it can reach the wrong tools or combine harmless permissions into a harmful chain. This is where the article’s emphasis on allow lists and intent-to-tool alignment is directionally correct. Practitioners should govern the execution envelope first and the model second.

Agentic AI will widen security debt if organisations keep relying on post hoc monitoring. Logging, dashboards, and review queues are useful, but they do not substitute for blocking at the action boundary. The longer deployment teams delay runtime enforcement, the more they normalise delegated authority without containment. Practitioners should treat enforcement as a design requirement, not an operational afterthought.

Agentic AI governance is converging with identity governance because the unit of risk is the delegated action. That convergence is why the field needs control models that join scope, reversibility, and accountability. The practical conclusion is clear: if an agent can act, it needs lifecycle controls that look much closer to identity governance than to classic model evaluation.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Irreversible action, not model quality, is the control boundary that most enterprise AI programmes are still missing. The moment an agent can change state, governance shifts from evaluating outputs to constraining execution. That means runtime policy, allow lists, and session-level enforcement now sit closer to the core of AI governance than traditional model scorecards.

Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption. That gap is not about enthusiasm, it is about control maturity lagging deployment speed. Programme owners should assume that agentic AI introduces identity-like governance requirements even when the system is not a human account.

For practitioners

• Define action boundaries before deployment Document every tool, API, dataset, and write path an agent can reach, then classify which actions are reversible and which require approval.
• Enforce allow lists at execution time Block any tool call that is not explicitly registered, instead of relying on model prompts or downstream log review to catch misuse.
• Add intent-to-tool alignment checks Measure whether the requested action still matches the task context during the session, and suspend execution when alignment drops below a defensible threshold.
• Test combined permissions, not single permissions Run adversarial scenarios across full multi-step workflows so you can see whether individually safe permissions become unsafe when chained.
• Separate observability from control Use logging for forensic traceability, but reserve blocking and session suspension for the point where an agent is about to cross an irreversible boundary.

Key takeaways

• Agentic AI creates a different class of risk because the harmful event can be an executed action rather than a bad model response.
• The weak point is usually the execution boundary, where permissions, tool access, and session context turn a model into a delegated actor.
• Teams need runtime enforcement, scope bounding, and identity-style governance before agents touch production systems.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Reversible Action: A reversible action is an automated step that can be safely undone or corrected without lasting operational harm. Examples include adding notes, changing severity, or creating a case. In SOC automation, reversible actions are the safest candidates for unattended execution because they preserve the ability to recover from a wrong decision.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Intent-to-Tool Alignment: Intent-to-tool alignment measures how closely an agent's chosen tool call matches the task it was given. When that alignment drops, the system may be drifting into an unauthorised or unsafe action path, so alignment is a practical runtime signal for blocking or escalation.

Deepen your knowledge

Our NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity. It helps security practitioners translate delegated access into controls that fit real operating models.