NIST AI RMF for agentic systems: what practitioners need to operationalize

At a glance

What this is: Akto’s guide says the NIST AI RMF is a sound governance scaffold for agentic and LLM systems, but it does not provide the technical controls needed to secure tool use, prompt injection exposure, or runtime AI behaviour.

Why it matters: IAM and AI security teams need to translate AI governance into enforceable controls, because agentic systems expand access, delegation, and decision-making beyond what policy-only frameworks can safely govern.

Context

The core problem is not whether AI governance exists, but whether it can control systems that make decisions and call tools in production. NIST AI RMF gives organisations a language for AI risk, yet agentic systems change the control problem by turning discovery, authorisation, and monitoring into continuous runtime concerns rather than one-time review tasks.

For identity and security teams, the important shift is that AI systems now behave like non-human actors with privileges, dependencies, and attack surfaces of their own. That means AI governance starts to overlap with NHI governance, especially where agents use MCP servers, API access, or other delegated credentials to act on behalf of business processes.

Key questions

Q: What fails first when the NIST AI RMF is used without technical controls for agentic AI?

A: The first failure is usually the gap between governance intent and runtime behaviour. Teams can document risk, but they still cannot stop an agent from using tools too broadly, following malicious instructions, or acting with authority that was never tightly enforced. That is why the AI RMF needs technical controls underneath it.

Q: Why do agentic AI systems create greater operational risk than standalone LLMs?

A: Agentic systems create greater operational risk because a successful attack can translate into an executed action, not just a harmful response. That action may write to a database, call an external API, or modify shared state before a human can intervene. The risk is therefore operational and immediate, which means testing must evaluate what the system can do, not only what it says.

Q: What are the signs that AI agent governance is too weak for production use?

A: Weak governance usually shows up as poor visibility into what agents can access, incomplete audit trails, and inconsistent oversight across security, legal, compliance, and operations teams. Another warning sign is when organizations cannot explain which datasets an agent used or why it took a specific action. Those gaps make investigation, containment, and compliance far harder.

Q: How should security teams respond when an agent gains more tool access than its task requires?

A: They should treat that as an authority problem, not just a configuration issue. Contain the agent’s reach, revoke or reduce the delegated permissions, and revalidate the workflow before it is allowed to continue. The important question is whether the task still needs the access it was given.

Technical breakdown

Why the NIST AI RMF stops at governance

The NIST AI RMF is deliberately a governance framework, not a control catalogue. Its Govern, Map, Measure, and Manage functions help organisations structure accountability and risk assessment, but they do not tell teams how to secure tool calling, restrict agent permissions, or detect prompt injection in a live workflow. That design makes the framework broad enough for many sectors, but it also means practitioners must add a technical layer for implementation. In agentic environments, the gap matters because an agent’s risk is defined by what it can reach at runtime, not only by what the policy says it should do.

Practical implication: Use the AI RMF as the operating model, but pair it with prescriptive controls for permissions, runtime monitoring, and agent task boundaries.

How agentic AI changes the attack surface

An agentic system is not just an LLM generating text. It plans, decides, and executes multi-step work using external tools, which means every connected service becomes part of the security boundary. Once a customer database, payment system, email client, or MCP server is in scope, the agent’s effective privileges must be understood as a security design issue, not merely an application feature. This is where AI governance intersects with identity governance: the agent needs a verifiable identity, tightly scoped authority, and a clear access lifecycle. Without those controls, the system can accumulate excessive agency even when the model itself remains unchanged.

Practical implication: Inventory every tool, connector, and delegated credential an agent can use, then constrain each one to the minimum necessary scope.

Why measurement and manage controls need runtime evidence

The guide’s strongest point is that measure and manage only work when they produce real evidence. For LLM and agentic systems, that means red teaming for prompt injection, output validation for leakage, and behavioural analysis for tool misuse or memory manipulation. Static documentation cannot reveal whether an agent is overstepping its intended task envelope in production. In practice, the control problem shifts from asking whether the model is approved to asking whether the system is continuously proving safe enough to keep running. That is a governance-to-operations transition, not a model-risk footnote.

Practical implication: Build continuous testing and runtime guardrails into the measurement loop so AI risk is observed, not assumed.

Threat narrative

Attacker objective: The attacker aims to turn a trusted agent into a delegated execution path that can expose data or misuse connected systems.

1. Entry occurs when an attacker reaches an agent-facing interface or a connected tool path and feeds malicious instructions into the workflow.
2. Credential or privilege abuse follows when the agent uses delegated access, tool permissions, or connected services to carry out unintended actions.
3. Impact occurs when the agent exfiltrates data, misuses business systems, or performs actions under its legitimate identity that the organisation did not intend.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI governance is becoming an identity problem before it is a model problem. The NIST AI RMF is useful because it creates an organisational language for risk, but agentic systems fail in the gaps between policy and runtime authority. Once tools, connectors, and delegated credentials enter the picture, identity lifecycle discipline becomes part of AI governance, not a separate workstream. Practitioners should treat every agent as a governed non-human actor with a bounded identity and measurable authority.

There is now a runtime control gap in AI governance that the base framework does not close. NIST’s four functions describe what good risk management should achieve, but they do not prescribe how to enforce tool permissions, detect prompt injection, or stop excessive agency in production. That gap is exactly where security teams need prescriptive standards such as OWASP Agentic AI Top 10, NIST AI 600-1, and agent identity guidance. The implication is straightforward: governance without enforcement creates assurance theatre.

Continuous discovery is the new prerequisite for AI assurance. The article correctly treats agent inventories, MCP connections, and live testing as operational necessities because decentralised agent adoption makes undocumented systems the default failure mode. That makes discovery and measurement inseparable from access governance. Practitioners should assume they do not fully know their AI attack surface until runtime controls and automated inventory prove otherwise.

AI governance debt will accumulate wherever teams treat the AI RMF as a one-time compliance exercise. The framework works best when organisations turn its functions into repeatable control loops with evidence, ownership, and incident response. Where they stop at policy documents, agent sprawl, unreviewed connectors, and uncontrolled tool use will keep expanding. Security leaders should measure whether AI governance actually changes system behaviour, not whether it produces more documentation.

Named concept: agent authority drift. This is the gradual gap between what an AI agent was approved to do and what it can actually do once tools, permissions, and integrations accumulate. It is the central governance failure mode in agentic environments because authority can expand faster than review cycles. Practitioners should design controls that revalidate authority whenever the agent’s tools or context change.

From our research library:

• Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
• Read next: Agentic AI Identity Maturity Model

What this signals

Agent authority drift: once an AI system can call tools, its real security boundary is the set of permissions it can exercise at runtime, not the model card or governance policy. That means access review for AI must be tied to tool inventory, connector scope, and continuous revalidation of delegated authority.

The most practical response is to treat AI risk as an identity and enforcement problem inside the broader governance model. Organisations that still rely on static credentials for agentic deployments are exposing a control gap that policy alone will not close, and the control point moves from approval to runtime enforcement.

Because agent inventories change quickly, the map of AI systems can become stale almost as soon as it is written. Continuous discovery and runtime guardrails need to become part of the operational baseline, not special projects that appear only after a security review.

For practitioners

• Define AI agent identity boundaries Assign every agent a unique, bounded identity and document which tools, connectors, and data sets that identity may reach. Reassess those permissions whenever the agent’s task scope changes.
• Operationalise continuous agent discovery Track agents, LLM applications, and MCP server connections automatically so the inventory reflects live reality rather than self-reported spreadsheets. Discovery should feed the Map function continuously.
• Test for prompt injection and excessive agency Run repeatable red team exercises that probe instruction hijacking, tool misuse, and over-permissioned behaviour in production-like conditions. Use the results to trigger control changes, not just report findings.
• Enforce runtime guardrails on tool calls Block or flag risky actions at the moment an agent attempts them, especially where connected systems expose customer data, financial flows, or administrative functions. Static approval alone is not enough.
• Document residual AI risk with incident response ownership Treat Manage as an operating process with named responders, decision thresholds, and post-incident review, so AI issues are handled as part of security operations rather than ad hoc escalation.

Key takeaways

• The central risk is not the AI RMF itself, but organisations using it as a governance document without the runtime controls needed to constrain agentic behaviour.
• Agentic systems expand the security boundary because tool access, delegated permissions, and live integrations become part of the attack surface.
• The control answer is continuous discovery, measurement, and enforcement tied to AI identity and access governance, not one-time approval.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• NIST AI Risk Management Framework: A voluntary framework for organizing AI risk governance around clear outcomes rather than fixed compliance steps. It helps enterprises define accountability, map AI context, measure risk, and manage treatment, but it does not itself provide enforcement or certification.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.
• AI assurance: AI assurance is the practice of proving that an AI system behaves as intended under normal and adversarial conditions. It combines validation, testing, monitoring, and evidence gathering so organisations can move from policy claims to measurable trust.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, IAM, and secrets management. It helps security and identity teams turn governance into operating controls across human and non-human access.