The agentic stack exposes where AI agent risk actually lives

At a glance

What this is: Salt maps AI agent risk to a three-layer agentic stack and argues that exposure often lives in MCP servers and APIs rather than only in the model.

Why it matters: IAM, PAM and AI governance teams need to govern the full agent-to-tool-to-API path because autonomous action changes where authorization, monitoring and accountability must sit.

Context

AI agents are not just chat interfaces with better language output. They are software systems that choose actions and then execute them through connected tools, which means the real security question is not only what the model says but what it can cause downstream. That is why the agentic stack matters: it exposes the layers where privilege, delegation and control actually concentrate.

For identity and access teams, the architectural shift is familiar even if the AI terminology is new. The risk is not confined to a prompt or a model boundary; it extends into machine identities, service permissions and API authorisations that let autonomous systems act inside enterprise environments. The article is about that governance gap, not about any single product or vendor implementation.

Key questions

Q: What breaks when an AI agent is allowed to call tools without strict scope controls?

A: The main failure is privilege expansion. A model can only act safely if every tool it can call is constrained by explicit scope, server-side validation, and audit logging. Without those controls, the agent can read files, trigger actions, or expose data far beyond what the user intended, turning a helpful assistant into an uncontrolled access path.

Q: Why do enterprise chatbots create more risk than consumer chatbots?

A: Enterprise chatbots are connected to systems of record and often operate with organisational authority. That means a single prompt can surface sensitive information, trigger actions, or create compliance exposure on behalf of the business. Consumer chatbots usually put the consequence on the user; enterprise chatbots place the consequence on the organisation.

Q: How do I know if an agentic security workflow is actually safe?

A: Look for reproducibility, deterministic policy checks, and complete audit trails. A safe workflow should produce the same governed outcome when rerun under the same conditions, and every action should be attributable to a policy decision rather than model improvisation. If that evidence is missing, the workflow is not ready.

Q: Should AI teams prioritise API posture governance before broader model controls?

A: Yes, when the model’s real risk comes from exposed interfaces, not from the weights themselves. If the system relies on APIs for data access, tool calls and orchestration, fixing the interface layer first usually delivers the fastest reduction in exploitability and privacy exposure.

Technical breakdown

Why the LLM is only the brain, not the control point

The LLM is the reasoning layer, but it does not itself perform enterprise changes. It selects goals, plans steps and decides which tools to invoke, which means model safety controls such as prompt injection defences and output guardrails only address one part of the chain. If the downstream permissions are broad, the model can still steer an agent into actions that create business impact. In other words, model alignment is necessary but not sufficient because execution authority sits elsewhere in the stack.

Practical implication: Treat model safety as one control plane and verify that downstream authorisation still constrains what the agent can do.

How MCP servers become the identity and privilege handoff

MCP servers sit between the model and the systems it can touch, so they effectively define the agent’s usable toolset and access scope. They may carry their own credentials, permission settings and service connections, which makes them a governance chokepoint rather than a neutral relay. In identity terms, they are where delegated authority is translated into operational reach. If the MCP layer is misconfigured or untracked, an attacker can reshape what the agent can access even when the model itself is behaving as expected.

Practical implication: Inventory MCP servers with the same discipline used for privileged integrations and review their credential scope and service reach.

Why APIs are the action layer that turns intent into impact

APIs are where autonomous intent becomes enterprise consequence. Agents can make large volumes of API calls quickly, and they do so without a human approving each action in real time. That changes the risk profile of weak object-level authorisation, overbroad endpoint access and monitoring that only watches the perimeter. Internal east-west API traffic is especially important because it often bypasses edge controls. Once an agent has valid reach into the action layer, scale and speed amplify any weakness in the API estate.

Practical implication: Shift monitoring and authorisation checks toward the API layer where the actual business action occurs.

Threat narrative

Attacker objective: The objective is to steer an apparently legitimate agent workflow into unauthorised enterprise actions by abusing the weakest layer in the stack.

1. Entry begins when an agent obtains access to an LLM prompt, an MCP server or an API path that can be influenced through normal workflow execution.
2. Credential access or privilege abuse occurs when the agent inherits or uses permissions from connected tools and services to reach systems beyond the model boundary.
3. Escalation happens through repeated autonomous API calls or through a compromised MCP layer that redirects the agent toward higher-impact actions.
4. Impact is the execution of unauthorised enterprise actions at machine speed, including data access, workflow manipulation or other downstream business effects.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

The agentic stack is an identity problem as much as an AI problem. The article’s most useful contribution is that it relocates AI agent risk from abstract model behaviour to the concrete places where authority is delegated and exercised. That matters because identity teams already understand that control breaks at the handoff point, not only at the point of intent. Practitioner conclusion: govern the agent’s reach, not just its output.

MCP servers are becoming the hidden control plane for agent privilege. Once an agent can invoke tools through MCP, the server is effectively mediating which services, data sets and actions the agent can touch. That makes MCP inventories, service scoping and credential ownership central governance tasks rather than optional architecture hygiene. Practitioner conclusion: treat MCP servers as privileged integration assets with explicit ownership and review.

Action layer drift: the security boundary is moving from model policy to API authorisation. The article is right that the majority of meaningful damage occurs where the agent can actually write, query, trigger or change something. Conventional perimeter tooling misses much of that east-west activity, so the governance model has to follow the action path instead. Practitioner conclusion: align monitoring and enforcement to the APIs that convert agent intent into production effects.

Autonomous workflows need relationship-based visibility, not isolated point controls. A single agent can connect to multiple tools, and a single tool can expose many downstream services, so the relevant question is the relationship graph, not just whether each component exists. This is where the identity of the agent, the scope of the MCP server and the permissions on the API must be viewed together. Practitioner conclusion: build an agentic security graph before you assume the stack is understood.

From our research library:

• Gartner predicts that AI systems will initiate 50% of all service requests by 2030, driven largely by agentic AI.
• Read next: AI Agent Authorisation Guide

What this signals

Agentic stack governance will increasingly look like identity governance for machines. Teams that already manage privileged access should recognise the pattern immediately: autonomy changes the cadence of review, but it does not remove the need to know who or what can act. The practical shift is toward inventories of agents, tools and APIs, plus tighter scoping at the point where authority is granted.

Action-layer monitoring will matter more than perimeter volume. As agents push more work through internal APIs, security programmes will need visibility into the sequence of intent, not just network events. That means building detection around tool choice, API reach and unusual call patterns, especially where east-west traffic is otherwise invisible to edge tooling.

Relationship graphs are the next useful concept in AI governance. The strongest control signal is not whether an agent exists, but how its permissions, tools and target systems relate to each other. Once those relationships are mapped, teams can decide where to apply least privilege, containment and review before the agent reaches production consequence.

For practitioners

• Map the full agentic chain Create an inventory of every AI agent, MCP server and API it can invoke, then record which permissions each component inherits and which business systems those calls can touch.
• Scope MCP server authority tightly Review each MCP server as a privileged integration point and remove credentials, capabilities and service connections that exceed the agent’s job requirement.
• Move controls to the API layer Validate object-level and function-level authorisation on the APIs agents can reach, especially where autonomous workflows can trigger writes, transactions or state changes.
• Monitor intent across the stack Correlate prompts, tool calls and API execution so analysts can distinguish a legitimate multi-step workflow from an agent being manipulated or misused.

Key takeaways

• AI agent risk is not confined to the model layer because MCP servers and APIs can turn benign intent into harmful execution.
• The decisive governance challenge is visibility into the full path from prompt to tool call to API action, especially inside east-west traffic.
• Practitioners should inventory agents, scope delegated authority and align monitoring to the layer where autonomous action becomes business impact.

Key terms

• Agentic stack: The agentic stack is the layer of tools, memory, orchestration logic, integrations, and policies surrounding an AI model. It is where a model gains the ability to take actions, reach data, and interact with systems, which is why many practical security failures happen above the model itself.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Action Layer: The action layer is the point where an identity moves from asking for access to doing something with that access. For AI agents, this layer matters because tool use can happen faster than human review, and the meaningful risk appears when actions are chained across systems.
• Sequence of Intent: The chain that connects an AI agent's goal, the tools it selects, and the API actions that result. The concept is useful because it lets defenders distinguish legitimate automation from harmful delegation, especially when actions happen quickly and through internal systems that are hard to observe.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity for teams that need to control autonomous access. It helps security and identity practitioners translate governance principles into operating models for machine actors.