They should govern the session, not the prompt. A multi-turn attack can look harmless in isolation, so controls need to retain identity, purpose, prior turns, and tool calls before authorising the next action. That shifts AI security from content filtering to runtime policy enforcement and gives teams a defensible audit trail.
Why session-level policy is the right control boundary
Multi-turn attacks exploit the gap between what a single message looks like and what a sequence of messages can achieve. If teams evaluate each turn in isolation, an attacker can gradually steer the model into disallowed actions while every individual prompt appears routine. The governing unit therefore has to be the session, with policy attached to accumulated state, not just the latest prompt.
That means the control plane should carry forward prior turns, declared purpose, tool history, and any prior policy decisions before the next action is authorised. When a system is built this way, guardrails can judge whether the conversation is drifting, whether a request is consistent with the original task, and whether the next tool call is still appropriate.
Teams also need to distinguish content filtering from runtime enforcement. Content filters are useful for screening obvious abuse, but they do not by themselves decide whether a tool can be called, a file can be written, or an external action can proceed. Runtime policy is what turns the conversation into a governed workflow rather than a loose sequence of text exchanges.
What attacks across multiple turns actually exploit
Multi-turn attacks usually rely on accumulation: a harmless-seeming request establishes context, a later turn narrows the target, and a final turn triggers the unsafe action. The attacker is not only trying to bypass a rule, but to make the system forget why it was acting in the first place. That is why session memory, purpose tracking, and tool-call continuity matter as much as the model output itself.
DPD chatbot incident 2024 is a good illustration of how apparently normal interactions can still lead to abusive model behaviour once the conversation context is steered over time. For teams, the lesson is that the visible content of one turn is not enough to judge trustworthiness if earlier turns have already shifted the state of the exchange.
Microsoft Azure OpenAI abuse by Storm-2139 shows the related operational risk when attacker-controlled access can be used to bypass safety expectations and repurpose the system. Multi-turn attacks become especially dangerous when the conversation can influence downstream action without a fresh policy check at the moment of execution.
How to govern guardrails so they survive the whole interaction
Effective governance treats the conversation as an object with state. The system should record identity, declared intent, prior refusals, tool use, and material context changes, then compare the next action against that state before authorising anything new. If the state changes in a way that weakens trust, the guardrail should re-evaluate rather than inherit earlier approval.
AI Security Platform Buyer's Guide is useful here because runtime guardrails, AI gateways, and red teaming all need to be evaluated against the same question: can the control enforce policy after context has accumulated, not just before a prompt is accepted? Teams should prefer controls that can inspect conversation history, tool requests, and policy state together.
Anthropic GTG-1002 AI espionage campaign reinforces that agentic abuse is often a workflow problem, not a single-prompt problem. Once systems can chain tools or actions, the governance target is the sequence, the authority behind each step, and the checkpoint between steps.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF, NIST AI 600-1 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Multi-turn attacks abuse retained context to trigger unauthorized agent actions. |
| Recommendation — Require a fresh authorization check before each privileged tool or action. | ||
| NIST AI RMF | GV — Govern | Session-level guardrails are an AI governance control issue. |
| Recommendation — Define governance rules that evaluate context across the full AI session. | ||
| NIST AI 600-1 | GOVERN — Governance | GenAI governance must manage runtime behavior, not only input content. |
| Recommendation — Apply runtime governance controls that re-evaluate decisions as context changes. | ||
| MITRE ATLAS | AML.T0078 — Prompt Injection | Multi-turn manipulation is a common prompt-injection path in AI systems. |
| Recommendation — Model multi-turn manipulation as prompt injection and test stateful defenses. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | AI guardrails are implemented as runtime application controls and validation. |
| Recommendation — Validate that runtime controls enforce policy before sensitive actions execute. | ||
Practitioner Guidance
What to verify: Confirm that every high-impact action requires a fresh policy decision based on session state, not a one-time allow decision at conversation start. If the model can call tools, write data, or contact external systems, the authorisation point must sit immediately before the action, not only at intake.
What to measure: Track how often the control re-checks context before execution, how often it blocks after a state change, and how often a later turn reverses an earlier harmless reading. Those signals tell you whether the guardrail is actually governing behaviour or merely filtering inputs.
Common mistake: Teams often overinvest in prompt screening and underinvest in session memory, tool gating, and auditability. That leaves a gap where the model can be manipulated gradually, then act with authority that was never revalidated.
Practitioner takeaway: The right design is a policy checkpoint on every consequential turn, because the attack surface is the evolving session, not the isolated prompt.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org