AI security for agentic workflows now depends on runtime controls

At a glance

What this is: This article argues that AI security for agentic workflows now depends on runtime controls because agent behaviour changes the threat model beyond static configuration and one-time deployment checks.

Why it matters: IAM, PAM, NHI, and AI governance teams need continuous visibility and enforcement because agentic systems can inherit, combine, and misuse access across tool chains faster than periodic reviews can catch.

Context

Agentic AI changes the security problem from protecting model inputs and outputs to governing systems that take actions. When an AI system can browse, call APIs, spin up other agents, and make sequential decisions, the core issue becomes runtime control over what it is allowed to do at each step.

That shifts the identity question from static authorisation at deployment to continuous enforcement during execution. For NHI, IAM, and PAM programmes, the relevant risk is no longer just access assignment, but whether tools, data, and delegated actions remain bounded as the workflow progresses.

Key questions

Q: What breaks when organisations rely on static access control for dynamic agentic workflows?

A: Static access control breaks down because agentic workflows change as business logic and execution paths change. If permissions are assigned at deployment and never re-evaluated at runtime, agents can accumulate excessive privileges and toxic access combinations. The result is poor visibility, weak enforcement, and limited ability to explain what an agent did or why.

Q: Why do agentic workflows increase security risk even when each tool is approved?

A: Approved tools do not guarantee safe behaviour when the sequence of actions is influenced by poisoned context or delegated instructions. Risk rises because the agent can combine individually allowed steps into an unsafe outcome, especially when it can browse, call APIs, and trigger other agents. The issue is behaviour across the chain, not any single tool invocation.

Q: How do teams know whether AI runtime enforcement is actually working?

A: Look for low-latency enforcement, consistent decisions across languages and encodings, complete telemetry, and repeatable blocking of risky content under load. A strong signal is that the control behaves the same in production-like conditions as it does in a lab, without creating user-visible pauses or blind spots.

Q: What should enterprises do when an AI agent attempts actions outside its intended task?

A: Block the action, log the intent mismatch, and review whether the agent’s policy boundary is too broad for the business process it supports. The goal is to contain scope drift before it becomes an unauthorized data export, system change, or external communication.

Technical breakdown

Why agentic workflows break static access control

Agentic systems do not just retrieve information. They execute multi-step tasks, call tools, and pass context between steps, which means permissions can be consumed and transformed inside a single workflow. Static controls assume the security boundary is set once and stays stable, but an agent can be redirected mid-task by poisoned retrieved content or a malicious tool response. That makes the execution trace itself part of the attack surface. In practice, the control point moves from initial authorisation to continuous evaluation of intent, scope, and tool use.

Practical implication: treat each step in the workflow as an enforcement point, not just the start of the session.

How prompt injection and context poisoning propagate across tools

Prompt injection is not just a model misuse problem. In agentic workflows, malicious instructions can arrive through retrieved documents, tool outputs, or downstream agent messages, then persist into later steps as context. Context poisoning is more dangerous because it does not need to win the first prompt. It only needs to influence the agent after trust has already been established. Once that poisoned context is used to select tools or generate follow-on actions, the system can take harmful steps while still appearing to behave normally.

Practical implication: validate retrieved content and tool responses at every hop, not only user prompts.

Why runtime guardrails matter more than deployment-time policy

The article's central technical point is that policy written at deployment is not enough for systems that keep acting after the first decision. Runtime protection has to inspect prompts, responses, tool calls, and delegated agent instructions continuously, because scope can drift as the task unfolds. Intent-based controls are especially important here because they monitor whether the sequence of actions still matches the agent's purpose. That is different from simply blocking known-bad inputs. It is about catching behaviour that has become unsafe even if each step appears individually permitted.

Practical implication: enforce tool scope and intent checks inline, before actions complete or propagate downstream.

Threat narrative

Attacker objective: The attacker aims to steer the agent into taking unauthorized actions or exposing data while the workflow still appears to be operating normally.

1. Entry occurs when a malicious instruction is embedded in a retrieved document, tool response, or delegated agent message that the workflow trusts.
2. Credential or authority abuse follows when the agent uses its inherited permissions to call tools, access data, or perform actions outside the user's intended scope.
3. Escalation happens as the poisoned context or redirected instruction is carried into later steps, compounding across multiple tool calls or sub-agents.
4. Impact is reached when the agent executes an unauthorized external action, leaks data, or propagates the compromised instruction chain into other systems.

Breaches seen in the wild

• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime control is the governing layer that agentic AI forces into view. Once an AI system can choose actions across tools and services during execution, the old assumption that authorisation is a provisioning problem no longer holds. Security decisions now have to happen inside the task, not just before it starts. Practitioners should treat workflow execution as a governed identity event, not just an application event.

Intent-based control becomes the decisive control plane for agentic systems. Rule-based controls can still catch known violations, but they do not explain whether a sequence of otherwise allowed actions still serves the task's legitimate purpose. That makes intent drift the real governance problem, especially when tools, retrieval sources, and sub-agents are all trusted by default. Security teams should judge behaviour against purpose, not just permission.

Visibility is the prerequisite for any credible AI security programme. Organisations cannot govern agents they do not know exist, and they cannot detect drift in systems they do not observe continuously. That is why discovery, posture, red teaming, and runtime enforcement have to operate as one loop rather than separate projects. The practitioner conclusion is straightforward: unknown agents and opaque tool chains are governance blind spots, not edge cases.

Least privilege must be reinterpreted for agentic execution. Least privilege was designed for bounded access scopes, but agents can acquire and use permissions dynamically across a live task. That assumption fails when the actor is autonomous because access decisions and action timing are no longer human-paced or predeclared. The implication is that privilege has to be controlled at the point of use, not only at the point of assignment.

Agent-to-agent trust chains create compounding risk that traditional delegation models miss. When one agent delegates to another, downstream systems may accept instructions that were never directly authenticated by a human operator. That expands the blast radius of a single compromised orchestrator and weakens accountability across the chain. Practitioners should assume that inter-agent messages are untrusted until proven otherwise.

From our research library:

• Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.

What this signals

Runtime controls are now the programme-level boundary for agentic AI. The governance model that worked for static software does not hold once a system can choose tools and act mid-task. Security teams need controls that operate during execution, because post-deployment review cannot catch behaviour that unfolds faster than a review cycle.

Agentic AI security is converging with identity governance. The key question is not only what the model can output, but what the workflow is authorised to do at each step. That means identity, privilege, and audit controls have to follow the execution trace, especially where sub-agents and third-party tools extend the chain of trust.

For practitioners

• Establish continuous AI asset discovery Inventory every AI agent, tool integration, model dependency, and delegated workflow path, including shadow AI and developer-deployed assistants that bypass normal review.
• Enforce runtime tool scope Apply inline authorization checks to every API call, data retrieval, file write, and delegated instruction so the agent cannot exceed its defined task boundary.
• Validate retrieved content and tool responses Treat documents, feed outputs, and agent-to-agent messages as untrusted inputs and inspect them before they can influence later steps in the workflow.
• Run adversarial testing before deployment Use red teaming to simulate prompt injection, context poisoning, and tool misuse across complete task chains, then feed findings into policy updates.
• Monitor behavioural drift continuously Track tool usage, refusal patterns, and task sequences against a baseline so anomalous changes can be isolated before data leaves the environment.

Key takeaways

• Agentic workflows change the security problem from protecting model outputs to governing action, privilege, and delegation during execution.
• Prompt injection, context poisoning, and tool misuse become more dangerous when one task can span multiple tools and sub-agents.
• Runtime enforcement, continuous discovery, and behavioural monitoring are the controls that determine whether an AI workflow stays inside its intended scope.

Key terms

• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Context Poisoning: Context poisoning is the manipulation of information that an AI agent reads before acting. The malicious content does not need to be code. If it changes the agent’s instructions, tool choices, or assumptions, it can alter behaviour and expand the impact of a compromised delivery path.
• Runtime control: Controls that enforce policy while an AI system is operating, rather than after the fact. For healthcare chatbots, runtime control includes data masking, output filtering, access scoping, and immutable logging so the organisation can defend the interaction itself.
• Intent-based control: Intent-based control is a security approach that evaluates what a user or system is trying to do, not just what data appears on the wire. For AI, this matters because prompts and responses can expose risk through context and meaning even when no obvious keyword or file transfer exists.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or AI governance programme, it is worth exploring.