Topic starter
11/07/2026 8:25 pm
TL;DR: AI agents combine LLMs, tools, prompts, and observability to create non-deterministic workflows that are harder to debug and govern than traditional software, according to Stytch. The key issue is that existing identity and control assumptions were built for stable execution paths, not runtime tool choice and within-session behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Stytch: “Agent ready episode 1 with Langflow: RAG workflows & agent development”.
Key questions
Q: How should security teams govern AI agents that choose tools at runtime?
A: Security teams should treat runtime tool choice as a governed access event, not a normal application call.
Q: Why do AI agents make existing IAM controls harder to rely on?
A: Because many IAM controls assume access is stable long enough to be reviewed, certified, and revoked later.
Q: What are the signs that an agent workflow is becoming too non-deterministic?
A: Common signs include inconsistent execution paths for similar prompts, opaque tool selection, repeated dependency on stale context, and outputs that cannot be reproduced from logs.
Practitioner guidance
- Define tool-boundary policy Specify which tools an agent may use, in what combinations, and under what session conditions before deployment.
- Instrument execution traces Capture tool calls, context changes, and intermediate outputs so every agent path can be reconstructed for review.
- Separate memory from authority Treat stored context as input, not entitlement.
Bottom line: AI agent workflows are governed by runtime decisions, so static application controls are not enough on their own.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:54 pm
Deterministic control is the missing governance layer for agentic systems. The article shows that autonomy without bounded execution creates workflows that are harder to reason about than conventional software. That is not simply an engineering inconvenience. It means identity and access control have to account for decision-making that occurs after the session starts, which changes how practitioners think about authorization boundaries.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should security teams decide whether an agent can use external tools?
A: They should authorise the session first, then allow tools only within that session’s scope. The decision should depend on cryptographic proof of the actor, the permitted task, and the destination, not on the tool name alone or the process path being present on an allowlist.
👉 Read our full editorial: Agent workflows need deterministic control, not just more autonomy