NIST AI RMF for agentic systems: what practitioners need to operationalize

At a glance

What this is: This guide explains how the NIST AI RMF applies to LLM and agentic AI systems, and its key finding is that governance alone is not enough without technical controls.

Why it matters: It matters because IAM, PAM, and AI security teams must now govern AI systems that act through tools and credentials, which creates identity, privilege, and oversight gaps across NHI and human programmes.

By the numbers:

• NIST published AI RMF 1.0 on January 26, 2023, following input from more than 240 contributing organizations across industry, academia, civil society, and government.
• NIST's Generative AI Profile, published as NIST AI 600-1 on July 26, 2024, identifies 12 risk categories unique to or amplified by generative AI.
• The OWASP Top 10 for LLM Applications 2025 ranks prompt injection as the top risk for the second consecutive edition.

👉 Read Akto's practical guide to the NIST AI security framework for LLM and agentic systems

Context

NIST AI RMF has become the default reference point for AI governance because many organisations need a common way to assess risk in systems that now generate text, call tools, and act across business workflows. For NIST AI security framework use cases, the main problem is not whether the document exists, but whether teams can translate its Govern, Map, Measure, and Manage functions into operational controls for agentic and LLM applications.

That gap matters for identity governance because AI agents increasingly operate through credentials, permissions, MCP connections, and delegated access paths that look a lot like non-human identities in practice. When organisations treat AI risk as a policy exercise only, they miss the control plane where identity, privilege, and runtime behaviour intersect.

Key questions

Q: How should security teams implement the NIST AI RMF for agentic AI systems?

A: Start with Govern and Map, but do not stop at policy and inventory. Tie each agent to an owner, a purpose, and a bounded set of tools, then make Measure and Manage continuous with red teaming, runtime guardrails, and incident response paths. Agentic AI needs identity-aware controls because its permissions can change faster than traditional review cycles.

Q: Why do agentic AI systems complicate identity governance more than traditional service accounts?

A: Traditional service accounts usually follow fixed workflows, while agentic systems can choose actions and sequence them at runtime. That makes access governance harder because the risk is not just possession of credentials, but the system's ability to combine privileges across tools and services in ways that static reviews do not capture.

Q: What breaks when organisations treat NIST AI RMF as a policy document only?

A: Measure becomes weak or absent, Manage becomes reactive, and the organisation loses visibility into how the live system behaves. The result is AI assurance without evidence. In practice, this leaves teams unable to prove whether prompt injection, excessive agency, or data leakage is actually being controlled.

Q: Which controls matter most when AI agents can use external tools?

A: Focus on tool authorisation, runtime policy enforcement, continuous discovery, and evidence-based monitoring. If an agent can reach databases, email, or payment workflows, the controls should limit scope, record actions, and prevent high-risk operations unless they are explicitly approved and auditable.

Technical breakdown

How the NIST AI RMF organises AI risk management

The NIST AI RMF is structured around four core functions. Govern establishes organisational accountability and oversight, Map identifies the context and risks of a specific AI system, Measure evaluates risks using qualitative and quantitative methods, and Manage treats those risks and documents residual exposure. For LLM and agentic systems, this structure is useful because it creates a repeatable operating model, but it is deliberately non-prescriptive. That means it can describe outcomes such as trustworthy AI, yet it does not specify the technical controls needed to secure tool use, memory, or delegated access.

Practical implication: Use the framework as an operating model, then pair it with control standards that specify how to secure AI tooling and runtime behaviour.

Why agentic AI creates a wider identity and privilege surface

An agentic system is more than a chatbot because it can plan actions, select tools, and execute multi-step tasks. Each connected system, such as a database, email client, or payment workflow, expands the attack surface and introduces new identity and authorisation decisions. In practice, this means the AI system inherits many of the same governance problems seen in NHI programmes: excessive privilege, unclear ownership, difficult lifecycle management, and weak visibility into what the system can do at runtime. The more tools an agent can call, the more the risk resembles workload identity and delegated access governance.

Practical implication: Inventory every AI tool connection as an identity and privilege decision, not just an integration choice.

Where AI RMF measure and manage still need technical reinforcement

NIST AI RMF expects organisations to measure and manage risk, but it does not prescribe how to detect prompt injection, prevent tool misuse, or control memory poisoning across a session. That is why security teams need runtime guardrails, continuous red teaming, output validation, and automated discovery of AI agents and MCP server connections. The framework is strongest when it drives evidence collection and control ownership, not when it is used as a substitute for technical security engineering. Without that layer, Govern and Map can look complete while the live system remains exposed.

Practical implication: Add continuous testing and runtime enforcement so Measure and Manage produce actual control outcomes, not just documentation.

Threat narrative

Attacker objective: The attacker aims to turn an AI system's legitimate tool access into unauthorised data access, workflow abuse, or downstream operational impact.

1. Entry begins when an attacker or prompt injection reaches the LLM or agent through a user prompt, tool input, or connected workflow.
2. Escalation occurs when the model is induced to misuse tools, exceed intended scope, or act on delegated permissions beyond what the task requires.
3. Impact follows when the agent leaks data, manipulates decisions, or performs unauthorised actions across connected systems.

NHI Mgmt Group analysis

NIST AI RMF is necessary governance scaffolding, not a complete security control set. The framework gives organisations a shared language for AI risk, but it stops short of telling security teams how to secure tool calls, limit memory abuse, or govern model-linked credentials. That is why AI governance programs must pair NIST AI RMF with prescriptive controls from agentic AI and NHI security practice. The practical conclusion is simple: the framework defines responsibility, not enforcement.

Agentic AI turns identity governance into a runtime problem. Once an AI system can choose actions and call tools, its risk profile starts to resemble a non-human identity with dynamic authority. That creates a new version of least privilege, one that must be enforced continuously rather than reviewed after the fact. This is where IAM, PAM, and workload identity disciplines intersect with AI governance, because a model that can act through delegated access needs the same lifecycle discipline as any other privileged system.

Continuous measurement is the difference between AI assurance and policy theatre. The most common failure pattern is publishing a policy, completing an inventory, and then leaving Measure underdeveloped because the organisation cannot generate useful evidence. AI governance debt: the gap between written AI policy and the runtime controls needed to prove the system is safe, secure, and accountable. Practitioners should treat that gap as a control deficiency, not an administrative delay.

MCP-connected agents sharpen the case for identity-aware AI controls. A model that can connect to tools and data sources via MCP is no longer just an information system, it is a delegated actor with explicit access pathways. That means the identity of the agent, the permissions on the tool, and the trust in the connection all need to be governed together. The practical conclusion is that agentic AI security belongs in the same governance conversation as NHI sprawl and privileged access.

The market is moving from AI principles to enforceable control layers. NIST AI RMF remains useful precisely because it is broad, but practitioners now need adjacent frameworks and telemetry to make it operational. That shift signals a category change: AI security programs are maturing from policy alignment toward measurable runtime governance. Security teams should assume auditors, boards, and incident responders will increasingly expect evidence, not aspiration.

What this signals

AI governance debt will become a recurring finding in security reviews unless teams connect policy language to runtime evidence. For practitioners, the question is no longer whether the framework exists, but whether each AI agent has an owner, a tool boundary, and a measurable control path from discovery to enforcement.

Agentic systems will keep expanding faster than manual review processes can absorb, which makes automated discovery and policy enforcement the practical baseline. Security teams should expect audit pressure to focus on whether their controls can prove what an agent accessed, what it did, and when that access should have ended.

For identity programmes, the immediate signal is that AI agents belong in the same governance conversation as service accounts and privileged workloads. The operational challenge is to extend existing IAM and PAM discipline into AI systems that make decisions dynamically, including those connected through MCP and other tool interfaces.

For practitioners

• Map every AI tool connection as a privilege decision Treat each database, email, ticketing, or payment connector as a distinct access path with an owner, scope, and expiry model. Include MCP server connections in the same review cycle as other delegated credentials so you can see where the agent can act and where it should not.
• Add continuous red teaming to Measure and Manage Run recurring tests for prompt injection, tool misuse, memory poisoning, and output leakage, then route the findings into remediation workflows with clear ownership. A one-time assessment does not satisfy the control intent of ongoing AI risk measurement.
• Build runtime guardrails around agent actions Enforce policy at execution time so risky tool calls are blocked or flagged before the agent completes the task. Pair the guardrails with approval thresholds for high-impact actions and monitor for excessive agency in production workloads.
• Inventory AI systems as part of identity governance Extend your identity and access inventory to include AI agents, LLM applications, and the credentials they inherit or call. If a system can act on behalf of a business process, it needs lifecycle ownership, review, and revocation paths like any other non-human identity.

Key takeaways

• The NIST AI RMF is useful for structure, but it does not by itself secure agentic or LLM systems.
• AI agents create a runtime identity and privilege problem that policy-only governance cannot close.
• Teams need continuous discovery, red teaming, and runtime guardrails if they want AI assurance that can survive audit and incident response.

Key terms

• NIST AI Risk Management Framework: A voluntary framework for organizing AI risk governance around clear outcomes rather than fixed compliance steps. It helps enterprises define accountability, map AI context, measure risk, and manage treatment, but it does not itself provide enforcement or certification.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• AI Governance: AI governance is the set of controls used to discover, classify, approve, restrict, monitor, and revoke AI-enabled access. It connects identity, data, and policy so organisations can manage what AI can reach, what it can share, and when it should be stopped.
• AppSec MCP Server: A context-sharing interface that connects application security tools, IDEs, CI pipelines, and policy systems through the Model Context Protocol. In practice, it helps security functions exchange state and guidance in a form that can support automation and inline developer assistance.

What's in the full article

Akto's full guide covers the operational detail this post intentionally leaves for the source:

• A practical walkthrough of how the vendor maps Govern, Map, Measure, and Manage to AI security workflows.
• Continuous discovery and red teaming examples for LLMs, agents, and MCP server connections.
• Runtime guardrail examples for tool misuse, memory poisoning, and prompt injection.
• Implementation lessons from applying the framework in live AI environments.

👉 Akto's full post covers framework functions, technical gaps, and continuous AI security controls in more detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners building stronger identity controls. It helps security teams connect identity discipline to the broader AI and access governance decisions their programmes now face.