TL;DR: AI threat modeling for agentic systems must account for prompt injection, unsafe tool use, poisoned retrieval data, excessive agency, and unauthorized access to sensitive systems because behaviour changes at runtime, according to Lasso Security. The practical shift is from static architecture review to continuous modelling of identity, permissions, trust boundaries, and tool-use paths before agents become embedded in business workflows.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Lasso Security's blog post: Agentic AI threat modeling must account for runtime decision-making, tool use, and access to business systems because static application models miss how agent behaviour changes in context.
Why it matters: That matters to IAM and security teams because agent identity, permissions, and trust boundaries become part of the control plane once AI can act, not just answer.
Context
AI threat modeling for agentic systems is the practice of mapping how prompts, retrieved context, tools, permissions, and external data can be manipulated to produce harmful actions. The core governance problem is that these systems are non-deterministic at runtime, so the attack surface changes as the workflow runs.
Traditional application threat models assume relatively stable flows and predictable execution paths. Agentic systems break that assumption because they can select tools, chain actions, and interact with sensitive systems dynamically, which creates a genuine intersection with identity, permissions, and delegated access governance.
Key questions
Q: What breaks when AI agents are not governed at runtime?
A: Without runtime governance, an agent can shift behaviour after provisioning and still execute actions that were never reviewed in context. That is where tool chaining, MCP connections, and rapid decision-making become dangerous. Static approval cannot stop a live change in intent, so teams lose control at the point of action.
Q: Why do agentic AI workflows create more risk than browser-based chat prompts?
A: Browser prompts are discrete interactions, but agentic workflows can chain tool calls, access data sources, and trigger follow-on actions. That sequence creates a larger attack and error surface because the harmful outcome may only appear after several apparently normal steps.
A: Common warning signs include agents issuing queries that touch data they do not need, calling tools outside the approved workflow, producing outputs that do not match the user request, or making repeated autonomous actions without review. Missing traces, weak audit logs, and unclear ownership are also red flags. If teams cannot explain what the agent accessed and why, governance is already failing.
Q: Should organisations use agentic AI threat modeling before production deployment?
A: Yes. The article’s logic supports modelling agents before they are embedded in business-critical workflows, because once they can access records, update tickets, or trigger actions, mistakes become operational incidents rather than architecture issues.
Technical breakdown
Why runtime behaviour changes the threat model for AI agents
Agentic systems are not just chat interfaces with a model behind them. They can interpret context, choose the next step, call tools, and decide how to respond, which means the control problem moves from fixed code paths to runtime decisions. That makes prompt injection, poisoned context, and tool manipulation materially different from conventional application attacks. The relevant question is not only whether the model is vulnerable, but whether the workflow allows an attacker to steer action selection once the agent has context and privileges.
Practical implication: model the runtime decision layer, not just the surrounding application architecture.
How identity and permissions become part of the attack surface
Once an AI agent can query CRM records, update tickets, send email, or trigger workflows, it effectively becomes part of the enterprise access layer. Its permissions are no longer abstract configuration details, because they determine which data it can reach and what actions it can take on behalf of a task. This is where IAM and NHI governance intersect with agentic AI: the agent may act through scoped credentials, delegated permissions, or cross-system access paths that must be inventoried, reviewed, and bounded like any other privileged actor.
Practical implication: inventory agent identities, scope their permissions, and govern them as non-human actors with explicit access boundaries.
Why untrusted content can turn into unauthorized business actions
Agentic workflows create indirect attack paths because retrieved content, tool output, or user input can influence later tool calls. In RAG and tool-using environments, a poisoned document or malicious instruction can alter what the agent retrieves, which tool it selects, or how it formulates arguments. That is why attack surface in agentic systems is dynamic rather than static. Security teams need to understand not only single-step failures, but chained execution paths where one untrusted input cascades into data exposure, workflow abuse, or misuse of external communication channels.
Practical implication: treat retrieved content and tool output as untrusted inputs and constrain which actions they can influence.
Threat narrative
Attacker objective: The attacker aims to manipulate an agent into making privileged decisions and taking unauthorized actions inside business systems.
- Entry begins when an attacker injects malicious instructions through prompts, retrieved content, or a compromised external data source that the agent trusts.
- Credential and tool abuse follow when the agent uses its permissions to query data, invoke tools, or trigger workflows based on manipulated context.
- Impact occurs when the agent reaches sensitive business systems and performs unauthorized access, data exposure, workflow abuse, or other harmful actions.
Breaches seen in the wild
- Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Runtime control is the real trust boundary for agentic AI. Static architecture diagrams are useful, but they do not govern what an agent does after it starts reasoning over context and calling tools. In practice, the trust boundary moves to the point where instructions, retrieved data, and tool permissions meet. Practitioners should treat runtime policy enforcement as part of the threat model, not as an afterthought.
Agent identity should be governed as a privileged machine identity problem, not a UI problem. Once an agent can query records, update tickets, or trigger workflows, it behaves like a non-human actor with delegated authority. That means inventory, scoping, review, and revocation matter in the same way they do for service accounts and other NHI patterns. The governance failure is not that the model is intelligent, but that its authority is often broader than its task.
MAESTRO-style layered analysis is a better fit than prompt-only review. The article’s substance supports a shift from single-layer prompt inspection to layered assessment across model behaviour, tool access, retrieval paths, runtime environment, and governance controls. That matters because agentic risk is composed from multiple weak signals rather than one obvious defect. Practitioners should map the full control stack before deploying agents into business-critical workflows.
Excessive agency is the named concept security teams should watch. The core failure mode in agentic systems is not simply access, but the combination of access, trust in context, and autonomous action selection. When those three align, the agent can be manipulated into doing the right thing in the wrong place. Practitioners should constrain the actions an agent can initiate, especially where sensitive data, external communication, and downstream business impact converge.
Continuous threat modeling is now an operating discipline. Agentic systems evolve as prompts, tools, models, memory, and integrations change, so a threat model that is not refreshed will drift out of date quickly. That makes monitoring and reassessment part of the governance model itself. Practitioners should tie updates to workflow changes, policy violations, and runtime findings rather than waiting for periodic review cycles.
From our research library:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- The agentic AI market is already worth $5 billion and is projected to reach $50 billion by 2030.
- Read next: Threat Modelling AI Agents
What this signals
Excessive agency is now a governance problem, not just a model-risk concern. When an agent can choose tools and execute actions, the control question shifts from whether the model is accurate to whether its authority is bounded. Security teams should expect runtime policy, scoped delegation, and action verification to become standard parts of AI governance.
Agent identity must be managed as a non-human control plane. The article’s strongest implication for practitioners is that AI systems with tool access behave like privileged machine actors, so IAM, NHI lifecycle, and approval controls need to converge. The 69% of security leaders who agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey, reflects that shift in operating assumptions.
Runtime enforcement will separate managed agents from shadow AI. Discovery alone is not enough when agents can change behaviour at execution time. Teams need continuous visibility into tool use, context trust, and cross-system dependencies so controls can follow the workflow rather than the diagram.
For practitioners
- Inventory every agent, tool, and MCP connection Capture each GenAI component in scope, what it can access, which systems it touches, and whether it can only answer or can also act.
- Scope agent permissions to the minimum task requirement Separate read, write, approval, and external communication capabilities so an agent cannot inherit broad access simply because it is useful in one workflow.
- Map trust boundaries across prompts, retrieval, and tool calls Document where untrusted content enters the workflow, where tool output changes later decisions, and where a higher-privilege system can be reached.
- Enforce runtime policy on sensitive actions Block or require approval for actions that expose data, trigger workflow changes, or communicate externally when those actions exceed the agent’s intended purpose.
- Reassess agent risk after every workflow or integration change Treat new prompts, model updates, memory changes, and added integrations as triggers for threat model refresh and control review.
Key takeaways
- Agentic AI changes the security problem because the system can decide, act, and cross trust boundaries at runtime rather than following fixed application logic.
- Identity and permission governance become central once an agent can access business systems, because delegated authority becomes part of the attack surface.
- Effective control depends on runtime enforcement, continuous threat model refresh, and explicit limits on tool use, data access, and external communication.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agent authority, delegated access, and privilege misuse in agentic workflows. |
| ASI02 — Tool Misuse | The core risk is unsafe tool selection and unbounded action execution by AI agents. | |
| ASI06 — Memory & Context Poisoning | Prompt injection and poisoned context are central to the article's runtime attack paths. | |
| Recommendation — Constrain agent authority and review delegated access paths that enable privilege abuse. Restrict tool invocation and approve high-risk actions before agents execute them. Treat retrieved content and memory as untrusted inputs and validate them before use. | ||
| MITRE ATLAS | TA0006; TA0008 — Credential Access; Lateral Movement | The article describes attacker paths that use agent permissions to reach additional systems. |
| Recommendation — Map agent abuse paths to credential access and lateral movement to improve detections. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The piece argues for governance, inventory, and accountability across the agent lifecycle. |
| Recommendation — Establish governance for agent inventories, delegated authority, and change-driven reassessment. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Service Accounts and Devices) | Agent credentials and non-human access are part of the control problem described here. |
| AC-6 — Least Privilege | Excessive agency and overbroad permissions are recurring risks in the article. | |
| Recommendation — Apply service-account authentication controls to bound agent access to business systems. Enforce least privilege so agents cannot exceed the minimum access required for their task. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Runtime control: Controls that enforce policy while an AI system is operating, rather than after the fact. For healthcare chatbots, runtime control includes data masking, output filtering, access scoping, and immutable logging so the organisation can defend the interaction itself.
- Trust Boundary: A trust boundary is the point where one system’s authority should stop and another system’s authority should begin. For internal automation, weak trust boundaries let monitoring, remediation, and execution share privileges that should have remained separate.
- Excessive agency: A condition where an AI system is given more operational authority than its task requires. The risk is not just poor output. It is that mistakes, manipulation, or compromise can produce destructive actions at machine speed across the systems the agent can reach.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and agentic AI identity. It helps security practitioners connect identity controls to the broader systems their programmes must govern.
Published by the NHIMG editorial team on July 22, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org