TL;DR: Enterprise AI security depends less on model guardrails than on the harness that governs context, tools, and execution, according to Noma Security's analysis of Fable 5, Mythos 5, and Daybreak. The article shows why least-privilege, step-level authorization, and inline enforcement matter when agents can access code, secrets, and production systems.
At a glance
What this is: This is an analysis of how agentic harness security, not model guardrails alone, sets the practical boundary for frontier models that can access code, tools, and enterprise systems.
Why it matters: It matters because IAM, PAM, and NHI teams now have to govern tool access, step-level authorization, and runtime enforcement around agents, not just the model behind them.
Context
Frontier models used inside agentic harnesses do more than generate text. They can traverse codebases, call tools, and act on enterprise data, which means the effective security boundary shifts from the model itself to the software wrapper around it.
That creates an identity and access problem as much as an AI problem. When a harness connects models to MCP servers, repositories, cloud control planes, and secrets, governance has to cover permissions, context boundaries, and execution rights together.
The article's core point is that model refusals are not a reliable control boundary once the harness can still route, authorize, or execute actions on the model's behalf.
Key questions
Q: What breaks when runtime guardrails are missing for agents?
A: The system loses the ability to stop unsafe inputs before they influence reasoning, block dangerous tool use before execution, and prevent sensitive outputs from reaching users. Without those checks, a legitimate request can be converted into an access event, and policy violations appear as normal behaviour.
Q: Why do agentic workflows increase the risk of indirect prompt injection?
A: Because they blend untrusted content and trusted instructions inside the same execution path. If logs, files, binaries, or retrieved documents can influence the model before the harness checks them, attacker-authored content can steer tool use, which turns a content issue into an access-control issue.
Q: How should security teams separate analysis, retrieval, and write access in agent deployments?
A: They should isolate read-only workflows from write-capable paths and require a new authorization decision before any state-changing action. That keeps the agent from carrying harmless access into deployment, code modification, or secret retrieval steps that carry higher blast radius.
Q: How do teams know whether their agent harness is actually under control?
A: Look for deterministic policy enforcement outside the model, complete inventory of connected tools and MCP servers, and separate treatment of trusted instructions versus untrusted content. If permissions still depend on what the model decides internally, the harness is not yet governing the boundary.
Technical breakdown
What a deployment harness changes in agent security
A deployment harness is the control layer around the model: the orchestration logic, API wrappers, retrieval pipelines, and tool executors that give the model operational reach. The model may reason over supplied context, but the harness decides what context enters the session, which tools are callable, and whether an action can be executed. In identity terms, the harness becomes the policy enforcement point, while the model remains a non-deterministic decision engine. That distinction matters because a refusal inside the model does not stop a permitted tool call if the surrounding system is still too broad.
Practical implication: treat the harness as the access boundary and scope permissions there first.
Why step-level authorization matters more than session trust
Session-wide trust is too coarse for agentic execution because the agent's intent can change across a multi-step workflow. Step-level authorization re-evaluates access at each decision point, so a read-only analysis step does not automatically inherit write permissions, deployment rights, or secret access. This is the closest analogue to zero standing privilege in an agentic workflow. It also reduces the damage from indirect prompt injection, since an injected instruction still has to clear a fresh enforcement check before the next tool call succeeds.
Practical implication: require per-action authorization for write paths, deployments, and any action that can change state.
How harness enforcement limits indirect prompt injection and tool abuse
Indirect prompt injection works because untrusted content and trusted instructions are processed in the same context window. If an attacker can poison logs, documents, binaries, or retrieved artifacts, the model may follow attacker-authored instructions unless the harness inspects inputs and intercepts tool calls outside the reasoning loop. That is why decoupled enforcement matters: the policy engine must operate independently of model interpretation. In practice, this means sanitising inputs, constraining tool scopes, and blocking unapproved calls before execution rather than after the fact.
Practical implication: move validation and tool gating outside the model context so hostile input cannot rewrite policy.
Threat narrative
Attacker objective: The attacker aims to manipulate agent execution so the harness authorizes unsafe actions that reach code, secrets, or production systems.
- Entry occurs when hostile content is introduced through logs, files, dependency metadata, or other retrieval sources that the harness feeds into the model context.
- Credential or permission abuse follows when the agent is allowed to combine that untrusted context with write access, deployment rights, or secrets exposure.
- Escalation happens when a tool call or destructive action is executed at machine speed before human review can interrupt the workflow.
- Impact is the loss of trust in the harness boundary, with code changes, data deletion, or unauthorized system actions carried out under apparently legitimate agent execution.
Breaches seen in the wild
- Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Harness security is now the real control boundary for frontier models: model guardrails are only advisory once the surrounding system can still route tools, data, and permissions. The article correctly shifts the question from what the model refuses to what the harness permits. Practitioners should read that as a governance change, not just an architecture tweak.
Step-level authorization is the agentic equivalent of Zero Standing Privilege: access that persists for an entire session is too blunt for systems that can alternate between analysis, retrieval, and write actions. A multi-step agent can move from harmless to destructive within one workflow, so security decisions must be rechecked at the moment of action. The practical conclusion is that identity policy has to be bound to execution state, not just to login state.
Context poisoning is a policy problem, not only a content problem: when untrusted input and trusted instructions share the same reasoning loop, attacker-authored content can influence tool use even if the model is well aligned. That means the control gap is the harness's inability to separate instruction authority from retrieved content authority. Teams should treat retrieved data, logs, binaries, and dependency metadata as privileged inputs that require governance.
Shadow AI extends beyond undiscovered models to undiscovered tool paths: the article shows that untracked MCP servers, custom wrappers, and internal executors can create hidden access routes even when the model itself is known. This broadens the NHI problem from secrets and service accounts to agent-to-tool relationships that may never appear in traditional IAM inventories. The implication is that discovery must include tool inventory and permission mapping, not only model inventory.
Runtime enforcement must be decoupled from model reasoning: if policy lives inside the same loop that the attacker can manipulate, it is not a control boundary. The article's architectural answer is inline enforcement outside the model context, which is the only place deterministic decisions can consistently constrain non-deterministic behaviour. Practitioners should treat that separation as the minimum viable boundary for agent deployment.
From our research library:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Agentic harness security creates a new governance boundary: once models can call tools and traverse enterprise context, access decisions have to move from model behaviour to harness policy. That is a practical identity issue, because the control point now sits around the agent's permissions, not inside the model.
Runtime policy must outrank prompt instructions: if the same loop can both interpret and enforce policy, attacker-authored content can still win. Decoupled enforcement is the only durable way to stop tool misuse when the agent can act across multiple steps.
Context poisoning becomes more visible as agentic systems scale: 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec. That concern should push teams to govern retrieved content as an input class, not a passive data source.
For practitioners
- Define the harness as the access boundary Inventory every place the model can see context, call tools, or execute actions, then assign each path a named owner and an explicit permission scope.
- Enforce step-level authorization for write paths Require a fresh decision for deployments, code commits, secret access, and any state-changing action instead of inheriting session-wide trust.
- Separate read-only and write-capable workflows Keep analysis, triage, and retrieval paths isolated from code execution, production changes, and destructive operations so one workflow cannot cross privilege boundaries.
- Inspect untrusted inputs before retrieval reaches the model Sanitise logs, documents, binaries, and dependency metadata before they are fed into context so attacker-authored instructions cannot shape tool selection.
- Continuously discover shadow agent assets Track MCP servers, custom wrappers, connected tools, and undocumented data paths so every agentic access route is visible to governance.
Key takeaways
- Agentic harness security shifts the practical security boundary away from model refusals and toward the wrapper that controls context, tools, and execution.
- Step-level authorization and decoupled enforcement are the controls that matter when an agent can move from analysis to action inside one workflow.
- Undiscovered tools, MCP servers, and write-capable paths create the blast radius that traditional model guardrails cannot contain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agents gaining too much operational reach through the harness. |
| Recommendation — Constrain agent privileges and bind tool use to explicit authorization at each step. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Harnesses authenticate agents and tools, and weak boundary checks let access flow too far. |
| NHI-05 — Overprivileged NHI | The article repeatedly warns against broad write access and unbounded tool scope. | |
| NHI-10 — Human Use of NHI | Human operators still trigger and supervise agentic workflows that can act through NHI paths. | |
| Recommendation — Enforce strong authentication and authorization for every agent-to-tool interaction. Reduce NHI scope to task-specific permissions and remove standing write access. Separate human initiation from machine execution and make every delegated action auditable. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article's access-control patterns depend on managing credentials and task-scoped access. |
| AC-6 — Least Privilege | Least privilege is central to limiting tool access, write paths, and destructive capability. | |
| Recommendation — Apply authenticator lifecycle controls to issue, limit, and revoke agent credentials on demand. Limit every agent and tool path to the minimum permissions needed for the task. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The threat narrative includes credential abuse and movement across connected tools and systems. |
| Recommendation — Map agent abuse paths to credential access and lateral movement to prioritise detection coverage. | ||
Key terms
- Agentic Harness: The orchestration layer that lets a model choose tools, execute actions, and repeat a task loop until a goal is met. In practice, it is what turns a model from a responder into an actor, so identity and privilege controls must govern the harness, not just the model.
- Step-Level Authorization: A control pattern that re-evaluates permission at each sensitive decision point instead of granting a broad session-wide allowance. For autonomous or agentic workflows, it narrows the blast radius of a single task and keeps action-by-action accountability intact.
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Decoupled Enforcement: A design where policy decisions are enforced outside the model's reasoning loop. The control engine remains deterministic even if the model is probabilistic, which matters when attacker-controlled content can influence model output. This approach keeps safety rules from becoming just another prompt.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on September 6, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org