What breaks when organisations rely only on static rules to govern agent behaviour?

Why This Matters for Security Teams

Static rules look reassuring because they are easy to audit, but they are a poor fit for agent behaviour that changes with prompts, tools, context, and goals. Once an AI agent can decide which action to take next, the security problem is no longer just “was a rule triggered?” It becomes “was the action appropriate for this intent, at this moment, with these inputs?” Guidance from the NIST AI Risk Management Framework and NHIMG research on the OWASP NHI Top 10 both point to the same operational truth: autonomy breaks assumptions that worked for deterministic workloads.

That matters because agents do not just read data, they chain tools, call APIs, and transform one subtle instruction into a high-impact action. Static allowlists and signature-based detections can miss prompt injection, tool abuse, and low-and-slow exfiltration that never looks like traditional malware. In practice, many security teams encounter these gaps only after an agent has already taken an unsafe action, rather than through intentional policy design.

How It Works in Practice

Effective agent governance starts by shifting from pre-defined rules to runtime decisioning. Instead of asking whether an action matches a fixed pattern, teams should ask whether the agent is authorised for the specific intent, data, tool, and environment it is touching right now. Current guidance suggests combining policy-as-code with real-time context evaluation, using control planes that can inspect the task, the requested resource, the user boundary, and the agent’s current trust state.

That usually means three things working together:

• Workload identity for the agent, so the system knows what the agent is before it gets access.
• Just-in-time, ephemeral credentials, so access exists only for the task and is revoked on completion.
• Runtime policy checks, so every tool call can be evaluated against current context instead of yesterday’s assumption.

This is where static IAM fails. Role-based access control assumes stable job functions, but agents behave opportunistically: they may need one tool now and a different one seconds later, depending on what the model infers from the prompt. That is why many practitioners are moving toward workload identity patterns such as SPIFFE and short-lived OIDC tokens, alongside controls described in the CSA MAESTRO agentic AI threat modeling framework and NHIMG’s coverage of the CoPhish OAuth Token Theft via Copilot Studio.

In practice, rule-only controls fail when the environment allows agents to browse, invoke plugins, and hand off tasks across multiple systems because the blast radius is created by the chain of allowed actions, not a single blocked event.

Common Variations and Edge Cases

Tighter agent controls often increase operational overhead, requiring organisations to balance autonomy against governance friction. That tradeoff is especially visible in high-change environments where agents support engineering, customer support, or security operations and must interact with many tools in rapid succession. There is no universal standard for this yet, so the best practice is evolving rather than settled.

One common edge case is partially trusted automation, where an agent can draft actions but a human must approve execution. Another is delegated access across systems with different policy models, where a single static rule set cannot express the full workflow. In those cases, teams should favour short-lived secrets, per-tool authorization, and explicit escalation paths instead of broad standing permissions. NHIMG’s research has repeatedly shown that long-lived secrets and excessive privileges amplify these failures, especially when paired with agentic workflows and exposed APIs.

For practitioners comparing standards, the most relevant external references are the OWASP Top 10 for Agentic Applications 2026 and the MITRE ATLAS adversarial AI threat matrix, because both reinforce that runtime context, not static patterns, is what determines real exposure.

Related resources from NHI Mgmt Group

• What breaks when organisations rely only on static analysis for AI agent skills?
• What breaks when organisations rely on endpoint security to govern LLM prompts and agent tool calls?
• What breaks when organisations rely only on password complexity rules?
• What breaks when organisations rely on detection after an agent acts?