Notifications
Clear all
Topic starter
21/08/2026 4:46 pm
TL;DR: Prompt injection, tool misuse, credential inheritance, and poisoned memory all need traceable telemetry, policy workflows, and monitored evaluation paths, according to Arize’s guide mapping OWASP Agentic Security Initiative risks to observability controls. The practical issue is not whether agents are useful, but whether current governance can still detect and constrain their behaviour before scope expands beyond approval boundaries.
NHIMG editorial — based on content published by Arize: OWASP Top 10 for Agentic Applications: Compliance Guide
By the numbers:
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams govern AI agent tool calls without exposing credentials?
A: Security teams should place credentials in a separate execution layer, not in the model context, and bind every tool call to a distinct agent identity.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What breaks when an agent relies on poisoned context or memory?
A: Future decisions break because the attacker has altered the agent's working state, not just one prompt.
Practitioner guidance
- Instrument agent action lineage Track user identity, session context, credential source, tool invocation, and response output in a single trace so investigators can reconstruct the full delegation path.
- Apply approval gates to high-impact agent actions Require human-in-the-loop approval for actions that can alter systems, move data, or expose credentials, and make the gate visible in the trace record.
- Version-control prompts and tool definitions Store prompt templates, tool schemas, and approval status under change control with signed attestations, then block production updates that bypass review.
What's in the full article
Arize's full guide covers the operational detail this post intentionally leaves for the source:
- Exact Arize AX tracing, eval, and monitor configuration patterns for each OWASP Agentic Security Initiative risk.
- Prompt Hub workflows for version control, signed attestations, and approval gating on prompt changes.
- Dashboards and metric examples for tool latency, invocation frequency, and agent trajectory analysis.
- Dataset and experiment design for testing prompt injection, tool misuse, and memory poisoning scenarios.
👉 Read Arize's guide mapping OWASP agentic security risks to observability controls →
OWASP agentic security guide: are your agent controls keeping up?
Explore further
21/08/2026 5:05 pm
Agentic security is becoming an identity governance problem, not just an AI safety problem. Once an agent can inherit credentials, call tools, and retain state, the governance question shifts from model output quality to delegated authority. That places IAM, PAM, and NHI controls on the same board as prompt safety and evals. Practitioners should treat agent identity, not only model behaviour, as the control boundary.
A question worth separating out:
Q: Who is accountable when an AI agent exceeds its intended scope?
A: Accountability should follow the delegation chain, not stop at the agent label. The human requester, the policy owner, and the team that granted underlying access all matter, because the agent acts within a permission model someone designed. If the chain is unclear, the governance model is already too weak.
👉 Read our full editorial: OWASP agentic application risks expose gaps in agent governance
