OWASP agentic application risks expose gaps in agent governance

At a glance

What this is: This is Arize’s compliance guide for OWASP agentic security risks, and its key finding is that observability, evals, and audit workflows must be built around agent behaviour rather than assumed from traditional application controls.

Why it matters: It matters because agentic systems can inherit credentials, misuse tools, and persist poisoned context, which means IAM, PAM, and AI governance teams need shared controls for identity, privilege, and runtime monitoring.

By the numbers:

• 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.

👉 Read Arize's guide mapping OWASP agentic security risks to observability controls

Context

Agentic security now sits at the intersection of AI governance, identity governance, and runtime control. The core problem is that an agent can act, call tools, and inherit context in ways that look like ordinary automation but behave more like a delegated identity with decision latitude.

Arize’s guide is useful because it translates OWASP agentic risks into operational signals such as tracing, evals, monitors, and approval workflows. For IAM and NHI teams, that matters because the control question is no longer only who authenticated, but what the agent was allowed to do, with which credentials, and under which constraints.

This is a typical problem for organisations moving from chat-style AI to agentic workflows, where the governance model often lags the deployment model.

Key questions

Q: How should security teams govern AI agent tool calls without exposing credentials?

A: Security teams should place credentials in a separate execution layer, not in the model context, and bind every tool call to a distinct agent identity. The key controls are scoped consent, execution-time secret injection, and unified audit logging. That way the model can request actions without ever seeing the material that authorises them.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: What breaks when an agent relies on poisoned context or memory?

A: Future decisions break because the attacker has altered the agent's working state, not just one prompt. Poisoned context can survive across sessions, bias tool selection, and create repeated unsafe behaviour. That turns a single successful injection into a persistent governance problem rather than a one-off incident.

Q: Who is accountable when an AI agent exceeds its intended scope?

A: Accountability should follow the delegation chain, not stop at the agent label. The human requester, the policy owner, and the team that granted underlying access all matter, because the agent acts within a permission model someone designed. If the chain is unclear, the governance model is already too weak.

Technical breakdown

Prompt injection and goal hijacking in agentic workflows

Prompt injection and goal hijacking occur when malicious instructions alter an agent’s intended objective, either through direct user input or through poisoned retrieved content. In agentic systems, this is more dangerous than a one-off bad prompt because the agent can chain actions, retain context, and apply the manipulated objective across multiple steps. That makes traceability, contextual validation, and session-level evaluation critical. A useful control model treats every prompt, retrieval, and response as security-relevant telemetry rather than just product analytics.

Practical implication: instrument prompt traces, retrieval quality checks, and session-level evals before allowing agents to perform high-impact actions.

Tool misuse, over-privileged delegation, and credential inheritance

Tool misuse happens when an agent can call legitimate APIs, services, or plugins with more privilege than the task requires. In practice, the risk is often not the tool itself but the delegation path: the agent inherits credentials, reaches sensitive data, and then operates beyond the human user’s intent. This creates an identity governance problem as much as an AI one. If the agent’s effective privilege is opaque, neither access review nor incident response can reliably reconstruct what happened.

Practical implication: bind each tool call to user, session, and credential provenance so over-privileged delegation becomes visible and revocable.

Agentic supply chain, memory poisoning, and cascading failure

Agentic systems load prompts, tools, plugins, models, and memory stores dynamically, so compromise can enter through runtime components rather than only through static software dependencies. A poisoned prompt template, corrupted memory entry, or untrusted MCP server can distort later reasoning and produce cascading failures across the workflow. This is why agent governance must include signed prompt management, component attestation, and drift detection for embeddings and memory. The security boundary is the execution graph, not just the model endpoint.

Practical implication: apply component attestations, prompt version control, and memory drift monitoring to every agent workflow that can persist state.

Threat narrative

Attacker objective: The attacker aims to turn an apparently normal agent workflow into a trusted execution path for unauthorized access, data exposure, or control-plane manipulation.

1. Entry begins when a malicious prompt, poisoned retrieval source, or untrusted runtime component influences the agent’s next action.
2. Escalation occurs when the agent inherits credentials or uses legitimate tools with privileges broader than the task requires, turning guidance into access.
3. Impact follows when the agent accesses sensitive systems, discloses credentials, or propagates corrupted context across downstream workflows.

NHI Mgmt Group analysis

Agentic security is becoming an identity governance problem, not just an AI safety problem. Once an agent can inherit credentials, call tools, and retain state, the governance question shifts from model output quality to delegated authority. That places IAM, PAM, and NHI controls on the same board as prompt safety and evals. Practitioners should treat agent identity, not only model behaviour, as the control boundary.

Tool misuse is really privilege misuse when the agent can act with opaque delegation. The article’s tracing and metadata model matters because it exposes who initiated the action, which credentials were used, and what the tool returned. That is the kind of evidence access reviews and incident response need but rarely get from generic AI logs. The practitioner conclusion is that privilege provenance must be first-class telemetry.

Memory and context poisoning create governance debt that persists after the original attack. Unlike a single malicious prompt, poisoned embeddings or persistent context can continue shaping decisions across sessions, which makes later validation harder. This is where the OWASP-NHI and OWASP Agentic AI Top 10 overlap: agent systems accumulate hidden authority in state, not just in tokens. Teams should assume that unverified memory is a standing trust dependency.

Agentic supply chain risk broadens the attack surface to runtime components and prompts. Dynamic loading of plugins, models, and MCP-style integrations means one compromised component can affect many downstream actions. That pattern does not fit traditional static dependency thinking. For practitioners, the message is clear: component integrity, prompt approval, and runtime attestation now belong in the same governance workflow.

Named concept: agentic delegation opacity. This article exposes a control gap where the effective authority of an agent cannot be reconstructed cleanly from standard logs. That opacity weakens auditability, access recertification, and incident containment. The practical conclusion is that agent workflows need explicit identity, privilege, and action lineage before they scale.

What this signals

Agentic governance will increasingly converge with NHI controls. Once an AI system can inherit secrets, use tools, and persist context, the programme question becomes whether the identity layer can describe and revoke that authority with enough precision. The most useful operating model is to treat the agent as a governed non-human identity with explicit provenance, bounded privilege, and monitored state.

Agentic delegation opacity: this is the practical failure mode most teams are underestimating. If the security team cannot reconstruct who approved the agent, what it inherited, and which tool path it followed, the organisation will struggle to investigate incidents or satisfy auditors. That makes lineage, attestation, and traceable approvals part of the control plane, not just the dashboard.

The governance signal for practitioners is that runtime monitoring alone is not enough. The programme needs policy on prompt updates, tool registration, memory trust, and credential inheritance, ideally aligned to the OWASP Agentic AI Top 10 and the MITRE ATLAS adversarial AI threat matrix.

For practitioners

• Instrument agent action lineage Track user identity, session context, credential source, tool invocation, and response output in a single trace so investigators can reconstruct the full delegation path.
• Apply approval gates to high-impact agent actions Require human-in-the-loop approval for actions that can alter systems, move data, or expose credentials, and make the gate visible in the trace record.
• Version-control prompts and tool definitions Store prompt templates, tool schemas, and approval status under change control with signed attestations, then block production updates that bypass review.
• Monitor for memory and embedding drift Baseline normal retrieval and embedding patterns, then alert on anomalous clusters, low-trust retrievals, or persistent context changes that alter agent behaviour.
• Align agent governance to NHI controls Treat agents that inherit secrets or tokens as non-human identities and map them to least privilege, lifecycle review, and revocation workflows.

Key takeaways

• Agentic AI changes the control problem because authority can be inherited, delegated, and reused across workflow steps.
• The evidence shows a large visibility gap, with many organisations unable to audit what their agents access or how often they exceed scope.
• Security teams should align tracing, approval, and credential governance so agent behaviour is auditable before high-impact deployment expands further.

Key terms

• Agentic security: The practice of governing software actors that can choose actions, tools, and timing in production workflows. It extends identity, authorization, logging, and lifecycle control to agents so their behaviour is tied to a verifiable principal and a revocable permission set.
• Credential Inheritance Channel: A credential inheritance channel is a mechanism that passes authentication-related state from one process to another, such as an environment variable or temporary secret directory. These channels are useful only when origin is trusted and controlled. If an attacker can influence them, they can redirect or bypass privileged authentication logic.
• Memory Poisoning (ASI06): An attack where malicious content is injected into an AI agent's memory or context, causing it to alter its behaviour in subsequent tasks — potentially exfiltrating secrets, escalating privileges, or acting against its intended purpose.
• Tool Misuse: Tool misuse occurs when an agent uses an allowed integration in a way that exceeds its intended task, scope, or risk tolerance. The problem is often not access alone but the combination of valid credentials, broad permissions, and unbounded action sequencing.

What's in the full article

Arize's full guide covers the operational detail this post intentionally leaves for the source:

• Exact Arize AX tracing, eval, and monitor configuration patterns for each OWASP Agentic Security Initiative risk.
• Prompt Hub workflows for version control, signed attestations, and approval gating on prompt changes.
• Dashboards and metric examples for tool latency, invocation frequency, and agent trajectory analysis.
• Dataset and experiment design for testing prompt injection, tool misuse, and memory poisoning scenarios.

👉 The full Arize guide includes tracing, eval, and monitor mappings for each OWASP agentic risk category.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps security practitioners connect identity controls to the realities of delegated AI behaviour and privileged access.