Should organisations rely on natural-language instructions for agent governance?

Why This Matters for Security Teams

Natural-language instructions are valuable for expressing intent, but they do not create a control boundary. For agents, the real risk is that the system can still execute, chain tools, or escalate privileges even when the instruction text says it should not. That is why security teams need machine-enforced checkpoints, not policy prose alone, as reflected in the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework.

In agentic environments, instructions are only as strong as the enforcement layer behind them. If a prompt says “approve only internal transfers,” but the agent still has API access to external systems, the instruction is advisory, not preventive. This gap shows up frequently in real incidents, including the patterns discussed in NHIMG coverage of CoPhish OAuth Token Theft via Copilot Studio and Gemini AI Breach — Google Calendar Prompt Injection. In practice, many security teams discover this only after an agent has already acted outside the intended scope.

How It Works in Practice

Effective agent governance treats natural-language instructions as one input to policy, not the policy itself. The operating model is: intent is declared in language, then checked by technical controls that decide whether the action can proceed. That usually means runtime policy evaluation, short-lived credentials, explicit approval states, and logging that captures what the agent tried to do, what context was available, and why the action was allowed or blocked.

This is where current guidance suggests using policy-as-code and workload identity rather than relying on prompt discipline. Frameworks such as CSA MAESTRO agentic AI threat modeling framework and NIST AI Risk Management Framework both point toward governance that is observable and enforceable. In practice, that means:

• Using natural-language instructions to define intent, then converting that intent into policy rules.
• Evaluating permission at request time, not at prompt creation time.
• Issuing just-in-time secrets or tokens for a single task, then revoking them automatically.
• Recording approvals, denials, and tool use in an audit trail that security and operations teams can review.
• Separating read, write, and destructive actions so an agent cannot silently expand scope.

NHIMG research on the OWASP NHI Top 10 reinforces the same pattern: agent safety depends on what the system can actually do, not what the instruction text hopes it will do. The practical test is simple. If a human reviewer or policy engine cannot veto the action before execution, the natural-language instruction is not governance. These controls tend to break down when agents operate across many tools, because chained actions make the effective blast radius much larger than any single prompt or role assignment suggests.

Common Variations and Edge Cases

Tighter control often increases operational overhead, requiring organisations to balance safety against speed and user experience. That tradeoff becomes sharper when agents are used in high-volume workflows, where excessive approvals can lead teams to bypass controls altogether. Best practice is evolving, but there is no universal standard for when language-only instructions are acceptable without a technical gate.

One common edge case is low-risk summarisation or drafting, where organisations may tolerate instruction-driven behaviour because the agent cannot directly change systems. Even there, the safer pattern is to restrict tool access and keep the model in a read-only mode. Another edge case is multi-agent orchestration, where one agent delegates to another. In those environments, the initial instruction often loses force unless each downstream agent receives its own policy check and scoped identity.

Security teams should also be careful not to confuse explainability with control. An agent may clearly state that it “understood” a restriction, yet still fail open if a tool call is not blocked technically. NHIMG analysis of Analysis of Claude Code Security and The State of Non-Human Identity Security both point to the same operational reality: policy text without enforcement does not reduce attack surface. In practice, organisations that rely on language alone usually find the failure only after an agent has already taken an irreversible action.

Related resources from NHI Mgmt Group

• What is the difference between human identity governance and AI agent governance?
• What is Microsoft Agent 365 in AI agent governance?
• When should organisations treat an AI agent as a privileged system?
• Why do AI agents make non-human identity governance harder?