Runtime control is becoming the main defense for AI interactions

At a glance

What this is: This is an analysis of why AI security failures increasingly cluster around prompts, orchestration and tool execution rather than model internals.

Why it matters: It matters to IAM and security teams because AI agents, workflows and external AI services now create governance gaps that traditional logging, review and perimeter controls do not reliably see.

Context

AI security problems increasingly arise where prompts, tools and orchestration meet, not where the model itself runs. That creates a governance gap because conventional logging and post-incident review miss the execution context that explains what the system was asked to do, which actions it took, and what data moved through the workflow.

The article’s central point is that runtime observability is now a control requirement for AI systems that can act, call tools or move data. Where organisations already struggle with agentic AI security, the failure mode is not only malicious output but unauthorised execution paths and ungoverned dependencies.

That starting position is increasingly typical for organisations adopting agentic workflows, but it is still under-governed in many security programmes.

Key questions

Q: What breaks when AI security only relies on logging and alerting?

A: Logging and alerting fail when the risky action finishes before a human can intervene. In that model, the security team learns about the exposure, but the prompt has already leaked data or triggered a tool action. The failure is not visibility itself, but using visibility as the primary control when the threat acts at machine speed.

Q: Why do autonomous agents create a bigger governance problem than chat-based AI assistants?

A: Chat-based assistants usually begin with a visible human prompt, so the initiation point is easier to govern and audit. Autonomous agents can start from external events, which means the triggering condition, payload, and connector become part of the identity attack surface. That expands the control problem beyond prompt content alone.

Q: What are the signs that shadow AI is leaking secrets?

A: Look for prompts containing API keys, tokens, connection strings, customer data, or regulated information, especially when the same workstation also runs local models or AI plugins. Repeated copy-and-paste into AI tools is a strong indicator that secret handling has escaped normal controls.

Q: When should organisations treat an AI agent as a privileged system?

A: Organisations should treat an AI agent as privileged whenever it can reach production data, administrative tools, or sensitive workflows without direct human approval for each step. At that point, the agent is no longer a passive automation helper. It becomes a governed identity whose permissions, logs, and exceptions need the same scrutiny as other high-risk access.

Technical breakdown

Why interaction-layer controls matter more than model-layer review

The interaction layer is where AI systems receive prompts, invoke tools, query services and emit outputs. Security failures often happen there because the model is only one component in a larger execution chain. Prompt injection, context poisoning and tool misuse do not require compromising the model weights; they exploit the trust the surrounding orchestration layer places in input, memory and action selection. That makes runtime inspection more valuable than delayed review, because the control point is the moment a request is interpreted and executed, not after the fact. In practice, the organisation needs visibility into prompt ingress, orchestration decisions and tool boundaries. See the Prompt Injection Guide.

Practical implication: Instrument the points where prompts become actions, not just where AI output is stored.

How agent execution creates a new privilege problem

Autonomous agents can accumulate risk across a sequence of apparently legitimate steps. Each individual tool call may look acceptable, but the chain can still produce unauthorised actions, unverified commitments or privilege escalation. This is a governance problem because the security question is no longer whether a single action was approved, but whether the execution path stayed within intended policy boundaries throughout the workflow. The important signals are tool usage, API activity and data movement between components. Without those, teams see only isolated events and lose the ability to reconstruct intent, sequence and boundary crossing.

Practical implication: Treat agent execution chains as governed workflows with bounded authority, not as simple log streams.

What shadow AI changes about data exposure and policy enforcement

Shadow AI becomes an access-control problem when sensitive source code, credentials or internal data is sent to external AI endpoints outside policy. The article highlights that the risk is not merely use of a public model, but uncontrolled outbound data flow that escapes the organisation’s approved governance path. That means detection has to watch prompts, outbound traffic and endpoint usage together. For identity and access teams, this is especially relevant because the same governance logic used for third-party access and privileged pathways now needs to extend to AI services and AI-driven workflows. See the Shadow AI and AI Agent Discovery Guide.

Practical implication: Apply policy to outbound AI traffic and approved endpoints, not only to user access to AI tools.

Threat narrative

Attacker objective: The attacker aims to steer AI-driven execution, exfiltrate sensitive data or induce unauthorised actions through trusted interaction pathways.

1. Entry occurs when a user, prompt, external service or agentic workflow introduces hostile instructions or unapproved data into the AI interaction layer.
2. Credential or control abuse follows when the orchestration layer accepts the injected instruction, issues tool calls or transmits sensitive content to an external endpoint.
3. Escalation happens when the agent continues acting beyond its intended boundary, including unauthorised actions, unverified commitments or privilege expansion across the workflow.
4. Impact is realised through data exposure, policy violation, fraud enablement or downstream security decisions made on corrupted execution context.

Breaches seen in the wild

• Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.
• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime enforcement is now a governance layer, not a monitoring enhancement. The article shows that AI risk is increasingly created at the moment of interaction, where prompts, tool calls and outbound exchanges are decided. That shifts the centre of gravity from retrospective logging to policy enforcement at execution time. Organisations that still treat AI logs as an after-the-fact record are governing too late. Practitioners should treat runtime controls as part of the AI security model itself.

Prompt injection is really a boundary-control failure. The important failure mode is not that malicious text exists, but that the surrounding system accepts untrusted instructions as executable context. That is why hidden directives, context poisoning and extraction attempts matter: they collapse the separation between input and authority. Prompt injection matters here because the attack succeeds when the system cannot distinguish content from control. Practitioners should harden the boundary where interpretation becomes action.

Shadow AI exposes a governance blind spot between identity and data control. When credentials, source code or internal documents leave approved channels and reach external AI services, the problem is no longer only data loss. It is also uncontrolled delegation to an external system that was never brought under the same access rules as sanctioned applications. That makes discovery of models, endpoints and prompts a governance requirement. Practitioners should extend access policy to AI endpoints as a managed dependency.

Agentic AI creates an execution-trust problem that traditional logging cannot solve alone. The article’s emphasis on sequence, context and behavioural traces is the right one. A chain of individually valid tool calls can still produce harmful output if the overall path is not constrained. This is where identity and privilege matter in AI operations, because agents effectively act as non-human actors with delegated authority. Practitioners should govern agent execution as a privileged pathway, not as ordinary application telemetry.

AI governance debt will grow fastest where policy cannot see the tool boundary. The named concept here is the tool boundary visibility gap: the space where orchestration, API calls and data movement happen faster than review processes can follow. That gap will be the main source of audit failure as organisations operationalise more agentic systems. The practical conclusion is simple: if policy cannot observe the action boundary, it cannot govern the action.

From our research library:

• 8 of the top 10 fastest-growing types of leaked secrets year-over-year are tied directly to AI services, according to the State of Secrets Sprawl 2026.
• Read next: Agentic AI Security Guide

What this signals

Interaction-layer security will become the default AI control model. As organisations move from chat interfaces to tool-using agents, the security boundary shifts to prompts, orchestration and outbound execution. That is why runtime control will matter more than periodic review. Teams that still govern AI as if it were only a content system will miss the moment where instructions become action.

Tool boundary visibility gap: the security problem is no longer just what the model says, but what the surrounding system allows it to do. That gap will drive most audit and containment failures in agentic environments, especially where external AI services are granted broad data access. The practical response is to watch for policy drift at the point of tool invocation and outbound transmission.

For practitioners

• Instrument prompt ingress and tool boundaries Capture prompts, orchestration decisions, tool invocations and outbound interactions as security events so AI workflows are observable at the point of execution, not only in retrospective logs.
• Block unapproved outbound AI data flows Detect and stop transmission of source code, credentials and internal business data to public AI endpoints that are outside policy, including endpoint-level restrictions where needed.
• Review agent execution chains, not isolated events Correlate tool usage, API activity and data movement so teams can reconstruct whether an agent stayed within expected behavioural boundaries across the full task sequence.
• Bring external AI dependencies under governance Inventory which models and endpoints are used, what data classes they receive and what policy constraints apply, then align them to your third-party access and approval model.

Key takeaways

• AI risk is moving toward the execution layer, where prompt handling, orchestration and tool use create the real governance exposure.
• Shadow AI and agentic workflows can leak sensitive data or trigger unauthorised actions even when model output appears normal.
• Runtime policy enforcement and boundary visibility are the controls that determine whether AI systems remain governable.

Related NHI Mgmt Group resources: Agentic AI Security Guide · Shadow AI and AI Agent Discovery Guide · Prompt Injection Guide · Generative AI Data Loss Prevention Guide

Key terms

• Interaction layer: The point where a user, agent, or automation interacts with the business flow, such as login, checkout, account creation, or API use. This layer matters because it exposes behaviour, not just network characteristics, and it is often where agentic misuse becomes visible before deeper compromise occurs.
• Context Poisoning: Context poisoning is the manipulation of information that an AI agent reads before acting. The malicious content does not need to be code. If it changes the agent’s instructions, tool choices, or assumptions, it can alter behaviour and expand the impact of a compromised delivery path.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It is designed for practitioners who need to connect identity controls to agentic AI and the broader security programme.