Agentic workforce security shifts from prompt filtering to runtime control

At a glance

What this is: This is an analysis of why agentic work now needs controls at the point of execution, not just prompt filtering, as agents operate with employee identity across endpoints and SaaS tools.

Why it matters: It matters because IAM, PAM and NHI programmes must account for software that can act with real credentials, make tool calls and move beyond what traditional prompt-level security can observe.

By the numbers:

• Prompts and outputs are 11% of what an agent does, while the other 89% are actions, including 51% tool calls.

Context

The security gap is no longer just what an AI system says. The problem is what it does after it gets a valid login, because an agent can use employee identity, reach internal systems and take actions that do not appear in a prompt log.

This shifts the control problem from content inspection to runtime governance. When agents operate on laptops, in browsers and in cloud sandboxes, the organisation needs visibility into the actions they take, not only the text they exchange.

AI agents vs agentic AI matters here because the distinction between a chat interface and a system that can act independently changes where identity controls have to live.

Key questions

Q: Why do prompt filters fail as the main control for AI agents?

A: Prompt filters only address the input layer, while most business risk appears after the agent has access to tools and data. Once an agent can make downstream choices, the dangerous action may be fully valid from a prompt perspective and still unacceptable from a governance perspective. Control has to extend to actions, not just text.

Q: Why do AI agents increase identity risk even when the login succeeds?

A: A successful login only proves that the agent reached the system. It does not prove that the specific action was authorised for that task, in that environment, at that moment. AI agents can chain tools and cross systems, so the authorisation problem moves to runtime intent and not just initial authentication.

Q: How should security teams govern agentic work across endpoints and cloud tools?

A: They should govern the full action path, starting at the endpoint where the agent launches tools and continuing through every system it can touch. The practical aim is to know where the agent can act, what data it can reach and which steps require tighter supervision or blocking.

Q: Should organisations treat agent activity differently from ordinary user activity?

A: Yes. Agent activity should be treated as delegated, high-speed identity activity because the software can combine access, automation and tool use in ways that ordinary user sessions do not. That difference justifies stronger observation, narrower scope and clearer approval boundaries.

Technical breakdown

Why prompt filtering misses agent behaviour

Prompt and output controls only inspect the conversational surface of an AI workflow. Once an agent receives a valid login, it can call tools, read data, open applications and trigger downstream actions that never appear in the prompt itself. That means the security boundary is no longer the model response, but the runtime environment where permissions, credentials and tool access converge. For agentic systems, security must cover the full action chain, not the visible text. Practical implication: inspect the runtime path, not just the prompt stream. See the LLM Security Guide.

Practical implication: Move security controls to the execution layer where agent actions actually occur.

Why employee identity changes the trust model

When an agent runs under an employee account, it inherits the same access pathways that a human worker would use, but with machine speed and no natural pause for review. That creates an identity problem, not just a model safety problem, because the organisation is treating software as if it were a person who will behave predictably within work hours and policy boundaries. In practice, the agent becomes an insider with delegated authority. Practical implication: treat agent sessions as privileged identity events, not just application sessions. See the AI Agent Authorisation Guide.

Practical implication: Classify agent sessions as privileged identity activity and govern them accordingly.

Why endpoint control becomes the new control plane

The article’s core mechanism is that the endpoint now acts as the remote control for agentic work. If the agent is operating in desktop apps, browsers or cloud sandboxes, then the endpoint becomes the place where tool use, data exposure and execution can be observed or blocked. This is materially different from model-centric guardrails, which do not control what happens after the model acts. The control plane moves closer to the user environment because that is where the agent lives and works. Practical implication: instrument the endpoint as part of the identity and access boundary. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: Extend monitoring and enforcement to the endpoint environment that hosts agent execution.

Threat narrative

Attacker objective: The objective is to turn legitimate agent access into unsupervised action that can reach business systems and carry out work at machine speed.

1. Entry occurs when the agent receives a valid employee login and can act inside the environment as an authenticated user.
2. Escalation happens as the agent uses that access to call tools, open applications and move beyond the prompt surface into real work actions.
3. Impact follows when those actions reach internal systems, cloud sandboxes or external services without a human watching the full sequence.

Breaches seen in the wild

• Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.
• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt filtering is now a partial control, not a primary control: The article correctly shows that text inspection only covers a narrow slice of agentic behaviour. Once agents can act through browsers, desktops and cloud tools, the more important question is what they are authorised to do after the prompt ends. Security teams should stop treating prompt safety as the main boundary and start treating it as one input to a wider runtime governance model.

Agentic access should be governed as delegated identity, not model output: When software acts with an employee login, the trust relationship changes from content moderation to access delegation. That means the real control question is who allowed the agent to inherit which actions, for how long, and under what monitoring conditions. This is where IAM, PAM and NHI governance converge on the same problem: software acting under human authority.

Endpoint visibility is becoming an identity control requirement: The most important place to observe agentic behaviour is no longer only the model gateway or chat interface. It is the endpoint where the agent launches tools, crosses application boundaries and turns identity into action. That pushes identity security teams toward runtime visibility because the visible surface and the actual control surface are now different things.

Runtime governance is the new agentic workload boundary: The industry needs a term for the control gap between approved model use and unsupervised execution. Runtime governance gap: the space where an agent is authenticated, authorised and active, but its real actions are not being governed at the point they occur. The practical conclusion is that agent security must be measured by action control, not chat control.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Runtime governance gap: the article points to a growing split between approved AI use and governed AI execution. Security teams will increasingly need to observe the agent’s actions at the endpoint and session level, because prompt inspection does not reveal the full work sequence.

The operational implication for identity programmes is that delegated authority will need tighter scoping, shorter-lived access and better session attribution as agents become part of ordinary work. That is especially true where a model can reach internal tools under employee credentials.

Manifold Security’s framing suggests that agentic security is now an access problem as much as an AI problem. The organisations that can constrain tool use, trace actions and separate human intent from machine execution will be better placed to govern the agentic workforce.

For practitioners

• Map agent actions, not just prompts Inventory where agents can open files, call tools, move through browsers and execute desktop actions under employee identity. Use that map to separate harmless text generation from privileged runtime behaviour. See the AI Agent Identity Security Buyer's Guide.
• Reclassify agent sessions as privileged events Treat agent logins as delegated access that may require stronger approval, tighter scope and closer monitoring than ordinary interactive use. Focus on what the session can reach, not just who started it. See the AI Agent Authorisation Guide.
• Instrument the endpoint as a control point Extend monitoring to the machine where the agent runs, because that is where browser actions, desktop operations and cloud sandbox activity can be observed together.
• Limit tool reach by task and context Reduce the number of tools and destinations an agent can touch in a single task so that a valid login does not become unrestricted operational reach.

Key takeaways

• Agents now create risk through actions, not only through prompts, so security controls have to move to the execution layer.
• The article’s own data says prompts and outputs are only 11% of agent behaviour, while actions make up the rest, which makes runtime visibility the governing issue.
• Identity teams should treat agent sessions as delegated privileged access and design controls around tool use, endpoint visibility and action attribution.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · AI Agents vs Agentic AI · AI Guardrails and AI Firewalls Guide

Key terms

• Agentic Workforce: A population of AI agents that operate inside an enterprise as autonomous actors with roles, access, and action authority. Unlike simple automation, these systems can choose tools, sequence tasks, and trigger downstream work. That makes them identity subjects that require governance, monitoring, and lifecycle control.
• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Delegated Identity: Delegated identity is when one actor acts on behalf of another with explicit permission and bounded authority. In AI-assisted commerce, it requires clear consent, limited scope, and traceable records so the retailer can distinguish authorised delegation from unauthorised automation.
• Security Control Plane: The security control plane is the management layer that defines, distributes, and enforces security policy across systems. It coordinates identity, access, telemetry, and response decisions, often across cloud, endpoint, network, and application domains. In practice, it is where authorization rules, trust signals, and enforcement actions are centrally governed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.