How do organisations reduce risk when agent schemas and workflows keep changing?

Why This Matters for Security Teams

Agent schemas and workflows rarely stay still for long. Tool calls are added, prompts are reworked, context limits shift, and multimodal inputs appear without warning. When telemetry is built around a fixed schema, security teams lose fidelity just when they need it most: during a workflow change, a rollout failure, or an abuse investigation. Current guidance from the NIST AI Risk Management Framework supports designing controls that remain usable as systems evolve, rather than assuming one model interface will remain stable.

The practical risk is not only missing data. Hard-coded schemas can also distort evidence, because nested tool arguments, chain-of-thought adjacent metadata, and multimodal payloads are often flattened or discarded before analysts see them. That creates blind spots in incident response, model governance, and abuse detection. It also makes it harder to compare behavior across versions of an agent or across different teams deploying their own workflow patterns. In practice, many security teams encounter these failures only after an incident review reveals that the telemetry never captured the change that mattered, rather than through intentional design.

How It Works in Practice

The most resilient approach is to treat event capture as an immutable intake layer and defer normalization until later. Raw events should preserve the original payload, timestamps, routing metadata, tool invocation details, model identifiers, and any attached artifacts. Enrichment can then add business context, risk labels, and policy tags without overwriting what was originally observed. This is especially important for agentic systems, where a single user request may trigger multiple tools, memory lookups, and downstream actions.

Security teams typically implement this as a two-stage model:

• Stage one captures the event exactly as emitted, including nested structures and unknown fields.
• Stage two maps the event to current analytics schemas for detections, dashboards, and compliance reports.
• Versioning is attached to prompts, tools, policies, and workflow definitions so analysts can reconstruct the execution path.
• Validation rules check for required metadata, but do not reject novel fields that may appear after a workflow update.

This pattern aligns well with control thinking in the NIST Cybersecurity Framework 2.0, especially where detection, logging, and response need to remain effective across change. It also supports threat-informed review using the MITRE ATLAS adversarial AI threat matrix, because analysts can preserve the raw evidence needed to test whether an attacker manipulated prompts, tools, or model outputs. For agent-focused hardening, the OWASP Agentic AI Top 10 and the CSA MAESTRO agentic AI threat modeling framework both reinforce the need to understand agent behavior as a chain of decisions, not a single static transaction.

This guidance tends to break down when teams force raw events into relational tables at ingest time, because schema drift and nested structures quickly outgrow the assumed field model.

Common Variations and Edge Cases

Tighter normalization often increases analyst convenience, but it also raises maintenance overhead, requiring organisations to balance fast search and reporting against long-term fidelity. That tradeoff becomes sharper in environments with multiple model providers, frequent prompt updates, or rapidly changing tool registries. There is no universal standard for this yet, so current guidance suggests preserving raw evidence first and applying opinionated structure only where the use case truly demands it.

Some teams can safely normalize a small set of stable fields, such as actor identity, model name, and action type, while leaving the rest as a raw envelope. Others need richer handling for multimodal data, especially images, audio, and file uploads that are critical to reconstruction but awkward in conventional SIEM pipelines. Agentic workflows also introduce edge cases where the same event may be both a security signal and an operational trace, so enrichment logic should avoid collapsing those categories too early.

For organisations building mature AI governance, the important question is not whether every event looks identical, but whether investigators can still recover the original execution path after the workflow changes. That is the point at which telemetry proves durable. The emerging best practice is to track schema versions alongside prompts and tools, while keeping the raw record intact for audits, model-risk review, and adversarial testing.

Related resources from NHI Mgmt Group

• How can organisations reduce risk from long-lived AI agent access?
• How can organisations reduce third-party access risk in GRC workflows?
• How do organisations keep delegation chains accountable in multi-agent workflows?
• How can organisations reduce the risk of prompt drift in AI-assisted workflows?