Agentic AI security stacks are converging around five layers

At a glance

What this is: Akto argues that agentic AI security is consolidating around five layers that govern discovery, identity, runtime, MCP boundaries, and red teaming.

Why it matters: This matters because IAM, NHI, and security teams now need a control model for agents, tools, and MCP servers, not just models and prompts.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.

👉 Read Akto's analysis of the agentic AI security stack landscape

Context

Agentic AI security is the set of controls that govern what AI agents can discover, access, decide, and execute across tools, MCP servers, data sources, and downstream systems. Akto's article maps a market that is moving beyond model-centric safety toward a layered identity and control plane for agent behaviour, which is the right framing for agentic AI security.

The practical problem is that many enterprises adopted agents bottom-up, so governance, identity, and runtime controls are fragmented across teams. That leaves security leaders trying to inventory shadow agents, define ownership, and stop excessive tool access after the systems are already in production, which is a common early-stage pattern in this market.

Key questions

Q: How should security teams govern AI-enabled workflows that can act on their own?

A: Treat them as identity-governed execution paths, not just software features. Assign a named owner, define least-privilege access, log every tool call, and require revocation paths for credentials and tokens. If the workflow can touch production systems or sensitive data, its permissions must be reviewed with the same discipline used for privileged machine identities.

Q: Why do agentic AI systems need more than prompt-level security controls?

A: Prompt-level controls only inspect content, while agentic systems create risk through tool use, workflow triggering, and downstream execution. Once an agent can act, security must govern identity, access scope, and runtime behaviour, because the real exposure comes from what the system can do, not only what it says.

Q: What breaks when organizations do not inventory AI agents and MCP connections?

A: Security teams lose the ability to answer what exists, what it can reach, and who owns it. Without that baseline, policy, monitoring, and incident response all become incomplete. The result is blind spots where agents can act, connect, and expand their effective scope without clear governance.

Q: How do organisations know if agentic AI governance is actually working?

A: Look for three signals: access decisions tied to task context, complete audit records linking agents to datasets, and rapid revocation when scope changes. If reviewers still need manual reconstruction after an incident, the programme is not mature. Effective governance produces explainable access, not just allowed or denied results.

Technical breakdown

Agentic AI discovery and governance as the control plane

Discovery and governance form the authoritative inventory for an agentic estate. In practice, that means finding agents, MCP servers, tools, resources, ownership, and data flows before attempting policy enforcement. This layer resembles CSPM in cloud because it exposes posture and configuration issues across a rapidly expanding surface. Without it, teams are guessing at who owns what, which privileges exist, and where agent-driven actions can reach. The security problem is not only visibility but policy scope: if the enterprise cannot enumerate agents and their connected tools, it cannot define meaningful guardrails or accountability boundaries.

Practical implication: build a single inventory of agents, MCP servers, tools, and data flows before assigning policy owners.

Identity of agents and the problem of NHI privilege drift

Once an agent can read data, call tools, and trigger workflows, it behaves like a non-human identity, even if business teams still treat it as a feature. That makes secrets, tokens, and permission scope the real control surface. The risk is privilege drift, where access broadens over time or through shadow deployment without formal review. In NHI terms, this is the same governance problem as over-permissioned service accounts, except the workload may be dynamic and faster-moving. Identity therefore becomes the bridge between agent registration and operational trust.

Practical implication: treat agent credentials, tokens, and permissions as governed NHIs with explicit ownership and review.

Runtime controls for prompt injection, tool misuse, and unsafe chaining

Runtime security checks the agent while it is acting, not after the fact. That includes inspecting prompts, responses, and tool calls for prompt injection, jailbreaks, data leakage, and unsafe chains of action. The key architectural point is that runtime controls sit in the request path, such as proxies, gateways, endpoints, or network layers, so they can block harmful behaviour as it occurs. This is distinct from governance and identity: those layers define boundaries, while runtime decides whether a specific action is safe in context. The closer the control is to execution, the more effective it is at stopping agent misuse.

Practical implication: place detection and blocking in the execution path for high-risk agent actions and sensitive data movement.

Threat narrative

Attacker objective: The objective is to use compromised or unmanaged agent identity and tool access to expand reach, extract data, or trigger harmful downstream actions.

1. Entry occurs when teams stand up agents, MCP servers, and workflow experiments faster than governance can inventory them.
2. Escalation happens when over-privileged agents, shadow deployments, or exposed tools let the system reach data and services beyond intended scope.
3. Impact follows when unsafe tool execution, data leakage, or harmful chained actions touch production systems and customer data.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI security is becoming a layered identity problem, not a model-safety problem. The article's five-layer stack is directionally correct because enterprises are now securing agents, tools, MCP wiring, and runtime behaviour rather than prompts alone. That shift matters because the security boundary is no longer the model response, it is the action surface created by identity plus tool access. Practitioners should stop treating AI security as a single control domain and map each layer to a separate owner and control objective.

Discovery and governance is the named concept that will decide whether the rest of the stack works. Without an authoritative inventory of agents, MCP servers, tools, and data flows, every downstream control becomes partial and reactive. This is the same structural lesson the cloud market learned with CSPM, except the agentic surface changes faster and is often distributed across business teams. The practitioner conclusion is simple: no inventory means no boundary, and no boundary means no governance.

Identity of agents is now a Non-Human Identity governance issue. Once agents can read data, invoke tools, and trigger workflows, their tokens and permissions must be managed like any other NHI, except with tighter scrutiny because the behaviour can change at runtime. That makes shadow agents and privilege drift the two most important failure modes to watch. Organisations that do not fold agents into NHI governance will end up with uncontrolled access even when runtime controls exist.

Runtime enforcement is necessary, but it does not replace upstream governance. The article correctly places guardrails in the request path because unsafe actions must be stopped where they occur. But runtime alone cannot recover ownership, provenance, or least-privilege design after the fact. The field should read this as a layered operating model: govern what exists, constrain what it can reach, inspect what it does, and test where it fails. Practitioners should align controls to those distinct decisions, not collapse them into one platform category.

Agentic red teaming should be treated as a validation discipline for action chains, not a one-time checklist. Agents can fail through objective drift, tool abuse, memory manipulation, and chained action sequences, which means traditional prompt tests are too narrow. The important shift is that security teams need continuous simulation of execution paths, not isolated content tests. The implication for practitioners is to measure failure at the boundary between intent and action, because that is where agentic systems break in production.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• A separate finding in the same research shows that only 52% of companies can track and audit the data their AI agents access, which leaves 48% with a compliance and investigation blind spot.
• For a broader category view, OWASP Agentic Applications Top 10 helps teams map agent behaviour risks to concrete defensive priorities.

What this signals

Discovery gap: As agentic AI spreads, the first programme gap is usually not advanced detection but basic inventory. Teams should expect more pressure to prove what agents exist, who owns them, and which tools they can reach, because those questions become the foundation for every other control decision.

With 92% of organisations saying governing AI agents is critical but only 44% having policies in place, the governance gap is already visible. That gap will push security leaders to separate policy design from runtime enforcement and to anchor both in a single operating model for agents and MCP infrastructure.

The next maturity step is to align agent governance with established guidance such as the NIST AI Risk Management Framework and the OWASP Top 10 for Agentic Applications 2026, then map those principles to internal ownership and review cycles. Programme teams that cannot link a control to a specific agent behaviour will keep finding the same gaps in different places.

For practitioners

• Build a complete agent and MCP inventory Catalog every agent, MCP server, tool, and downstream resource with named ownership, data flow mapping, and review dates so the security team can see the full action surface.
• Classify agent credentials as governed NHIs Assign explicit owners to tokens, secrets, and permissions used by agents, then review them for over-provisioning, shadow deployment, and drift from the approved use case.
• Enforce runtime blocking at the execution path Place controls at the proxy, gateway, endpoint, or network layer so unsafe tool calls, data leakage, and chained actions can be blocked in context before they complete.
• Separate governance, identity, runtime, and testing ownership Give each layer a distinct control objective and operating owner so inventory, access scope, live enforcement, and red teaming do not blur into a single undifferentiated AI security programme.
• Run continuous adversarial testing for agent behaviour Simulate prompt injection, tool misuse, and multi-step chaining regularly so failures are observed before production incidents expose them.

Key takeaways

• Agentic AI security is evolving into a multi-layer control model that spans discovery, identity, runtime, MCP visibility, and red teaming.
• The biggest practical failure is uncontrolled agent behaviour combined with missing ownership, which creates shadow access and privilege drift.
• Security teams need a named inventory, governed NHIs, and runtime enforcement before agentic deployments can be trusted at scale.

Key terms

• Agentic AI Security: Agentic AI security is the discipline of securing autonomous AI systems that can take actions, use tools, and chain decisions without direct human approval at each step. It covers identity and access management for AI agents, prompt injection defence, tool call governance, credential scoping, and runtime monitoring. As agentic systems acquire real-world authority — API access, file writes, workflow triggers — the security model must treat them as non-human identities with explicit lifecycle controls, not trusted processes.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Agent Privilege Drift: Agent privilege drift is the gap between the access an AI agent still has and the business context that originally justified it. As tasks, prompts and workflows change, permissions can remain in place longer than they should, creating hidden exposure in production systems.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.

What's in the full article

Akto's full post covers the operational detail this post intentionally leaves for the source:

• The full five-layer market map for agentic AI security and how vendors cluster across it.
• The article's detailed view of which control plane owns governance, identity, runtime, MCP proxying, and red teaming.
• The broader market-direction commentary on where enterprise budgets are likely to move in 2026.
• The source's discussion of how security may move directly into agents, MCP servers, and downstream application infrastructure.

👉 Akto's full post covers the five-layer model, market clustering, and where control points are moving next.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.