Topic starter
25/10/2026 11:07 am
TL;DR: Agentic AI security now lands at semantic boundaries across retrieval, tools and memory, according to Aryaka. Operation-level policy has to follow the workflow itself, so delegated execution gets checked before it reaches data or external systems.
Editorial analysis by NHI Mgmt Group, based on content published by Aryaka: “How OpenAI APIs Power RAG, Autonomous Agents — and How AI>Secure Inspects Them Safely”.
Key questions
Q: Why do prompt filters fail as the main control for AI agents?
A: Prompt filters only address the input layer, while most business risk appears after the agent has access to tools and data.
Q: How should security teams prevent data poisoning in RAG systems without breaking retrieval quality?
A: Security teams should enforce access control at the retrieval layer, not inside the LLM, and pair that with document filtering, source allowlisting, and response checks.
A: Security teams should treat agentic AI as a runtime identity and policy problem, not just a prompt filtering problem.
Practitioner guidance
- Implement operation-level policy enforcement Tie policy to specific OpenAI API paths and request types so embeddings, responses, conversations, audio and image operations are governed differently.
- Map validation to semantic boundaries Apply prompt injection checks to model inputs, schema validation to tool arguments, and grounding or DLP controls to retrieved content that re-enters the model.
- Restrict tool invocation by default Allow model output where appropriate, but deny tool execution unless the tool is explicitly approved, scoped and monitored for the task at hand.
Bottom line: Modern AI applications create security risk at multiple semantic boundaries, not just in the prompt itself.
Glossary terms: Agentic AI, Semantic Inspection, Tool Misuse, Workload Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Operation-level inspection is the right control model for agentic AI. The article shows that modern AI systems do not fail at the prompt alone. They fail at the points where prompts become tool calls, retrieved context, embeddings and executable intent, which is why security has to move from text filtering to boundary-aware governance. Practitioners should treat each operation as a distinct control decision.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: What is the difference between prompt injection and tool poisoning in agentic systems?
A: Prompt injection manipulates the content the model reads, while tool poisoning manipulates the tool itself or its description so the model follows malicious instructions. Both aim to control agent behaviour, but tool poisoning is especially dangerous because the abuse is embedded in a trusted integration path.
👉 Read our full editorial: API-level controls are now central to agentic AI security
This post was modified 7 days ago by NHI Mgmt Group