RAG and agentic AI require different security controls

At a glance

What this is: This article explains that RAG and agentic AI are not the same security problem, with RAG centring on retrieval-layer trust and agentic AI centring on autonomous tool use and NHI privilege exposure.

Why it matters: IAM, PAM, and NHI teams need to separate retrieval controls from action controls, because the governance model for an LLM answering questions is not the same as one executing tasks.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).

👉 Read Cyberhaven's analysis of RAG vs agentic AI security differences

Context

RAG and agentic AI are often discussed together, but they create different identity and access problems. RAG reads from an approved knowledge store and returns grounded answers, while agentic AI goes further and executes multi-step tasks through tools, databases, file systems, and APIs. For security architects, that distinction changes where trust is enforced and where privilege can be abused.

The first model concentrates risk in the retrieval layer, where poisoned content or weak access control can shape what the model sees. The second model shifts risk into runtime execution, where non-human identities, service accounts, and API tokens can move data and trigger actions across systems. That is why the primary security question is not whether the model is “AI”, but whether it merely retrieves context or actively acts on it.

Key questions

Q: How should security teams govern RAG and agentic AI differently?

A: Treat RAG as a retrieval governance problem and agentic AI as an execution governance problem. RAG needs source permissions, ingestion validation, and output auditing. Agentic AI needs least-privilege NHIs, approval gates for high-impact actions, and tracing across tool calls. If the same control set is used for both, one of the two risk models will be under-governed.

Q: Why do agentic AI systems make NHI risk harder to manage?

A: Agentic systems combine autonomous action with tool access, which means they can inherit the same credential, privilege, and lifecycle problems as other NHIs but at much higher speed. The challenge is not only access control. It is ensuring the agent’s authority is continuously bounded by policy, context, and revocation rules.

Q: What breaks when access review models are applied to agentic AI?

A: Access review models break when the actor can obtain, use, and release privileges before the review cycle sees a stable state. Agentic AI compresses the decision window so tightly that the entitlement may never exist long enough to certify, challenge, or revoke in a meaningful way. Governance has to shift toward runtime validation and action-level attribution.

Q: How can teams reduce risk when AI tools are connected to enterprise workflows?

A: Start by narrowing what the AI tool can see and do, then add monitoring for unusual access patterns and action chains. Put ownership on a named team, enforce expiry or revocation rules, and include the AI connection in privileged access reviews. That makes exposure visible before it becomes operational loss.

Technical breakdown

RAG security starts in the retrieval layer

Retrieval-augmented generation, or RAG, keeps model parameters unchanged and injects approved documents into the prompt at query time. That makes the retrieval pipeline the control point. If the index contains poisoned content, hidden instructions, or over-broad documents, the model can surface information it should not or follow embedded prompts it was never meant to trust. The model does not independently re-enforce source-system permissions. Once content enters the index, it is effectively available to retrieval unless the retrieval layer is protected.

Practical implication: enforce source-level permissions in the index and validate content before it is indexed.

Agentic AI turns NHI credentials into the control plane

Agentic AI is an execution pattern, not just a response pattern. The system plans, selects tools, and carries out actions across APIs, databases, browsers, and file systems, often through service accounts or long-lived API tokens. That shifts security from content trust to authority management. The main failure mode is not a bad answer, but a legitimate action taken with excessive privilege. Behaviour also becomes harder to classify because the agent can chain several individually authorised steps into an unauthorised outcome.

Practical implication: treat agent permissions as NHI governance, with tight scoping, approval gates, and auditability across the full action chain.

Prompt injection behaves differently when the system can act

Prompt injection in RAG usually aims at information disclosure because the model’s output is the main endpoint. In agentic systems, the same manipulation can trigger tool misuse, privilege escalation, or data exfiltration through chained actions. A single malicious instruction may cause the agent to read files, call external services, or move data without a human explicitly approving each step. This is why output filtering alone is insufficient. Security has to observe the action sequence, not just the generated text.

Practical implication: add tracing and approval logic for actions that can change state, move data, or reach external systems.

Threat narrative

Attacker objective: The attacker wants to convert trusted context or delegated AI execution into unauthorised data access, data movement, or operational actions.

1. Entry occurs when malicious content, poisoned retrieval material, or prompt injection enters the RAG corpus or agent interaction path. In agentic systems, the same content can also be delivered through email, chat, or other user-facing channels that the system processes as context.
2. Escalation occurs when the model trusts retrieved content or executes with broad NHI privileges, allowing hidden instructions to become tool calls, data access, or chained actions across systems.
3. Impact occurs when the agent exfiltrates data, modifies files, or performs unauthorised operations at a scale that is difficult to detect through traditional point-in-time controls.

Breaches seen in the wild

• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

RAG and agentic AI are different governance problems, not just different architectures. RAG is primarily a retrieval trust problem, where the question is which documents can influence model output. Agentic AI is a delegated execution problem, where the question is which systems an identity can touch and what it can do there. Conflating the two leads to the wrong control stack, because retrieval permissions do not equal action permissions. Practitioners need separate governance paths for response generation and runtime execution.

Agentic AI collapses the assumption that privilege is static enough to review after the fact. Access review was designed for identities whose entitlements persist long enough to be observed, certified, and removed on a human schedule. That assumption fails when an agent acquires and consumes privilege during a task chain, then moves on before any periodic review catches the state change. The implication is that governance models built on scheduled certification cannot reliably describe autonomous or near-autonomous access behaviour.

Prompt injection becomes materially more dangerous when the AI system can execute actions. In RAG, injection mostly contaminates an answer. In agentic systems, it can redirect a tool chain, move data, or trigger external side effects through legitimate credentials. That changes the risk from incorrect content to unauthorised execution. Security teams should read this as a control boundary problem, not a model-quality problem.

Least privilege must be interpreted differently once the actor is an AI system with tool access. For a retrieval-only pattern, privilege is about what the model can see. For an agentic pattern, privilege is about what the identity can do across tools, data stores, and external systems. Broad service accounts and long-lived API tokens become the escalation path. Practitioners should expect existing NHI assumptions to fail when action and identity are tightly coupled.

Identity blast radius is now the right unit of analysis for enterprise AI governance. The article shows that the security question is no longer whether an LLM is “safe”, but how far its delegated access can reach once it is connected to retrieval, tools, and write-capable systems. That crosses IAM, PAM, and NHI boundaries in one programme view. Teams that can map blast radius by actor type will govern AI adoption with far less blind spot.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That visibility gap is why OWASP NHI Top 10 and agent-specific governance need to move from theory into control design.

What this signals

Identity blast radius: the practical unit of control is no longer the model, but the set of systems, datasets, and APIs its delegated identity can reach. That is why AI security programmes need to distinguish retrieval trust from execution trust, then map both to identity boundaries. The most useful next step is to align agent permissions with NIST AI Risk Management Framework governance and the agentic risk patterns in OWASP Agentic AI Top 10.

With 98% of companies planning to deploy more AI agents within 12 months, according to the 2026 Infrastructure Identity Survey, the programme risk is not adoption itself but the lag between deployment speed and NHI control maturity. Teams should expect more service accounts, more API credentials, and more shared responsibility across security, legal, and compliance.

The governance signal to watch is whether your organisation can prove which identity acted, what it accessed, and which approvals existed at the moment of action. If that cannot be answered consistently, the problem is not model quality. It is identity instrumentation, and the remedy sits in IAM, PAM, and NHI process design.

For practitioners

• Separate retrieval and execution controls Map RAG pipelines to retrieval-layer permissions, but map agentic workflows to NHI, PAM, and approval controls across tools and APIs. The same policy set should not govern both patterns.
• Scope non-human identities to task boundaries Review service accounts and API tokens used by agents so they only hold permissions required for the defined workflow. Remove broad credentials that let an agent cross systems without a fresh authorisation decision.
• Add approval gates for irreversible actions Require explicit human approval before an agent can delete, transfer, or externally transmit data. Keep approval logic tied to state-changing actions, not just to prompts or outputs.
• Instrument tool-chain tracing Log retrievals, tool calls, data movement, and external requests as one correlated sequence so investigators can reconstruct how a model moved from context to action. Point-in-time output logs are not enough.

Key takeaways

• RAG and agentic AI should be governed as separate identity patterns because one retrieves context and the other exercises delegated action.
• The biggest security gap is not model intelligence but the breadth of non-human identity privilege behind tool-enabled AI systems.
• Programmes that cannot trace retrieval, tool use, and approval state in one chain will struggle to govern AI safely at scale.

Key terms

• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads — causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Cyberhaven's full blog covers the operational detail this post intentionally leaves for the source:

• Architectural examples showing how RAG and agentic AI differ in retrieval, tool use, and auditability.
• The article's practical comparison table for deciding which controls belong to retrieval layers versus action layers.
• Detailed guidance on least-privilege permissioning for non-human identities used by AI agents.
• The source discussion of prompt injection in Microsoft 365 Copilot and why multi-step traces matter.

👉 Cyberhaven's full post explains the retrieval attack surface, agentic workflow risks, and control mapping in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.