Topic starter
22/07/2026 4:32 pm
TL;DR: AI threat modeling for agentic systems must account for prompt injection, unsafe tool use, poisoned retrieval data, excessive agency, and unauthorized access to sensitive systems because behaviour changes at runtime, according to Lasso Security. The practical shift is from static architecture review to continuous modelling of identity, permissions, trust boundaries, and tool-use paths before agents become embedded in business workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Lasso Security: “How to Build an AI Threat Modeling Process for Agentic Systems”.
Key questions
Q: What breaks when AI agents are not governed at runtime?
A: Without runtime governance, an agent can shift behaviour after provisioning and still execute actions that were never reviewed in context.
Q: Why do agentic AI workflows create more risk than browser-based chat prompts?
A: Browser prompts are discrete interactions, but agentic workflows can chain tool calls, access data sources, and trigger follow-on actions.
A: Common warning signs include agents issuing queries that touch data they do not need, calling tools outside the approved workflow, producing outputs that do not match the user request, or making repeated autonomous actions without review.
Practitioner guidance
- Inventory every agent, tool, and MCP connection Capture each GenAI component in scope, what it can access, which systems it touches, and whether it can only answer or can also act.
- Scope agent permissions to the minimum task requirement Separate read, write, approval, and external communication capabilities so an agent cannot inherit broad access simply because it is useful in one workflow.
- Map trust boundaries across prompts, retrieval, and tool calls Document where untrusted content enters the workflow, where tool output changes later decisions, and where a higher-privilege system can be reached.
Bottom line: Agentic AI changes the security problem because the system can decide, act, and cross trust boundaries at runtime rather than following fixed application logic.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:54 pm
Runtime control is the real trust boundary for agentic AI. Static architecture diagrams are useful, but they do not govern what an agent does after it starts reasoning over context and calling tools. In practice, the trust boundary moves to the point where instructions, retrieved data, and tool permissions meet. Practitioners should treat runtime policy enforcement as part of the threat model, not as an afterthought.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- The agentic AI market is already worth $5 billion and is projected to reach $50 billion by 2030.
A question worth separating out:
Q: Should organisations use agentic AI threat modeling before production deployment?
A: Yes. The article’s logic supports modelling agents before they are embedded in business-critical workflows, because once they can access records, update tickets, or trigger actions, mistakes become operational incidents rather than architecture issues.
👉 Read our full editorial: AI threat modeling for agentic systems needs runtime controls