AI agent action perimeter exposes gaps in current security stacks

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Tego AI's blog post: AI security has shifted from prompt filtering to action-layer governance because agentic systems create risks through tool use, delegation, and runtime decisions rather than through the text they generate.

Why it matters: It matters because IAM, PAM, and security teams now have to control what an agent can do in-session, not just what a user asked it to say, especially where delegated credentials and autonomous execution are involved.

Context

AI security perimeter now means the boundary around an agent's actions, not the text it receives. Prompt filtering was built for chatbots, but agentic systems reason, plan, call tools, and chain decisions across execution loops, which shifts the governance problem from content moderation to runtime authorization.

The governance gap is that most enterprise controls still observe the conversation while the risk lives in the tool calls. That leaves organisations trying to secure stateful behaviour with stateless controls, which is why indirect prompt injection and over-privileged delegation can slip past traditional guardrails.

Key questions

Q: What breaks when organisations rely only on prompt filtering to secure AI agents?

A: Prompt filtering can reduce obvious abuse, but it does not stop a compromised agent that has already accepted malicious instructions or been manipulated through its environment. In practice, the attacker may pivot through tools, files, APIs, and connected systems after the prompt stage. Defenders need visibility into runtime behaviour, not just text exchanges.

Q: Why do autonomous agent sessions increase identity risk?

A: Because the same agent can hold a valid credential while moving through different tasks, and each task may justify a different level of access. When identity is static but purpose changes, overreach becomes easy to miss. The safer model is task-scoped authority with checks at the point of action, not at initial login.

Q: How should teams govern AI agent tool calls in real time?

A: Teams should govern AI agent tool calls with a runtime authorization layer that evaluates the principal, action, resource, and context on every request. Static roles are too coarse once agents can chain actions or carry delegated scopes across tools. The control point should be policy based, deterministic, and auditable so that each decision can be explained after the fact.

Q: What is the difference between role-based access and purpose-bound authorization for agents?

A: Role-based access answers what a generic identity may do in theory, while purpose-bound authorization asks whether this exact action is justified by the current task. For agents, that distinction matters because the same credential can be valid for one objective and inappropriate for the next. Purpose-bound controls narrow access to the live session instead of the static role.

Technical breakdown

Why stateless prompt filters fail against stateful agents

A stateless control evaluates each prompt in isolation, usually with classifiers, regex patterns, or similarity checks. That works when the model's risk is confined to one message, but it breaks when the agent's exposure accumulates over time across memory, tool calls, and multi-step reasoning. The dangerous behaviour often appears only in sequence: a harmless read, then a benign action, then an exfiltration path that becomes visible only when the full loop is examined. Execution-layer threats such as indirect prompt injection exploit exactly this gap, because the malicious instruction is embedded in data the agent reads rather than in the user input itself. See the Agentic AI Security Guide. See the Agentic AI Security Guide.

Practical implication: move monitoring from input screening to session-level behaviour analysis across every tool call and state transition.

Why workload identity must follow delegation chains

Agentic systems do not stop at a single identity boundary. Orchestrators spawn subagents, subagents call tools, and each hop can widen scope if identity and purpose are allowed to inherit loosely. Workload identity is the mechanism that lets each hop prove who it is acting for and why, instead of relying on a static role binding that was defined before the task existed. That is why conventional IAM struggles here: it models the identity as stable, while the agent's authority is conditional on the task in flight. Without cryptographic identity at each hop, delegation becomes opaque and privilege drift becomes normal. See the AI Agent Identity Security Buyer's Guide. See the AI Agent Identity Security Buyer's Guide.

Practical implication: require per-hop identity proof and narrow scope at each delegation point instead of trusting inherited credentials.

How runtime authorization changes the control plane

Authorization for agents cannot be purpose-blind or deferred until after execution. The same agent may legitimately access a customer record while resolving a support task and have no valid reason to touch that record during a later marketing workflow. That means the control plane has to evaluate context, task purpose, and risk in the moment of action, not just once at login or provisioning time. Runtime security therefore becomes the enforcement layer for the session, with graduated responses such as reinforcing instructions, revoking auto-mode, or stopping the session. The architectural point is simple: the unit of risk is the session, not the model or the user. See the AI Security Platform Buyer's Guide. See the AI Security Platform Buyer's Guide.

Practical implication: design policies that can change access mid-session based on task context and observed behaviour.

Threat narrative

Attacker objective: The attacker wants the agent to disclose data or execute actions outside the intended task boundary while remaining within apparently valid agent behaviour.

1. Entry begins when a malicious instruction is embedded in content the agent reads, not in the user prompt, so the agent ingests the attack while appearing to process normal data.
2. Credentialed execution follows when the agent uses delegated access to query databases, call tools, or read records that the attacker has influenced through the poisoned context.
3. Escalation occurs when the agent chains tool calls or repeats actions under auto-run, extending the attack beyond a single step and turning a safe-looking interaction into an exfiltration path.
4. Impact is the unauthorized disclosure or movement of sensitive records through the agent's own permitted actions, which makes the breach look like legitimate business processing until the full session is reviewed.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• 12,000 secrets in LLM training data: Truffle Security found 11,908 live API keys and passwords hard-coded in web pages captured by Common Crawl, a dataset used to train LLMs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Action-layer security is now the real perimeter for agentic systems. Prompt controls were never designed to govern independent tool use, chained decisions, or machine-speed execution loops. The core issue is not model output quality but whether an agent can be constrained at the moment it acts. Security programmes that still center on text screening are protecting the wrong boundary, and that mismatch will keep widening as agent deployments scale.

Stateless governance is a structural mismatch for stateful behaviour. A prompt filter can judge one input at a time, but an agent's risk emerges across memory, tool use, and delegation history. That means the control assumption behind old AI security models was that risk is local to the prompt; in agentic systems, risk is cumulative and contextual. The implication is that identity governance must move to runtime state, not stay locked to pre-authored policy.

Identity and privilege abuse becomes harder to define when scope is task-specific rather than role-specific. Agents can legitimately need different access at different moments in the same session, which breaks the traditional idea that a role can fully describe acceptable use. The practical consequence is that the organisation has to think in terms of purpose-bound authority and delegation-aware identity, not static entitlements. AI agent identity security becomes the governance layer that makes that possible.

Session-level risk is the most useful named concept in this market. The article's strongest insight is that a developer or operator may run several safe agent sessions at once while one session drifts into dangerous behaviour. That makes the session, not the user or the tool, the unit of control that matters. Security leaders should treat that as a governance model change, not a product feature request.

From our research library:

• Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
• Read next: Agentic AI Security Guide

What this signals

The next phase of AI security programmes is not more prompt blocking, but instrumentation that can evaluate actions as they happen. That requires security teams to think in terms of agent sessions, delegation hops, and runtime authorisation rather than model output alone.

Session-level risk: this is the governance shift that matters most for agentic AI. Once an organisation can run multiple concurrent agent sessions from the same user or endpoint, the only meaningful control is the ability to distinguish safe behaviour from risky behaviour in real time.

For practitioners

• Define the session as the control boundary Rewrite AI security policies so the monitored unit is the agent session, including tool calls, memory state, and delegation history, rather than the prompt alone.
• Inventory agents and their permissions Build a register of every agent, tool connection, delegated credential, and auto-run setting so you can see where authority exists today and where it is inherited without review.
• Enforce purpose-bound authorization Require access checks at the moment of action so the same agent cannot reuse a valid credential for a new task that no longer justifies the same data or tool access.
• Add graduated runtime responses Configure controls that can reinforce instructions, revoke auto-mode, or terminate the session when behaviour drifts outside expected task scope.
• Harden delegated identity paths Use cryptographic workload identity at each hop so orchestrators and subagents cannot silently widen scope through inherited trust.

Key takeaways

• AI agents expose a control problem that prompt filters cannot solve because the dangerous behaviour sits in execution, not text.
• The article's evidence points to a stateful attack surface where indirect prompt injection and delegated access can combine without triggering traditional guardrails.
• Security teams need session-level enforcement, task-scoped authority, and delegated workload identity if they want agentic systems to stay governable.

Related NHI Mgmt Group resources: Agentic AI Security Guide · AI Agent Identity Security Buyer's Guide · AI Security Platform Buyer's Guide · AI Security Maturity Model

Key terms

• Presentation-layer enforcement: A control model that applies policy where the user sees and manipulates information, rather than only at the network or storage layer. This can make data protection more precise because it distinguishes between access to an application and permission to copy, export or expose its content.
• Stateful Agent: An AI system that preserves context across multiple steps, retries, or sessions instead of answering in a single pass. The state can include tool outputs, task history, and intermediate decisions, which makes the agent more capable but also much harder to audit and secure.
• Purpose-bound authorization: An authorization model that grants access only for a declared objective, such as resolving a ticket or issuing a refund. It adds governance value by tying permission to intent, scope, and time, which helps prevent agents from continuing past the reason they were allowed to act.
• Delegation-aware identity: An identity design that preserves who the agent is acting for across orchestrators, subagents, and tool hops. It prevents authority from widening invisibly as tasks are handed off, which is especially important when one session can spawn several downstream actions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.