A single blocked action may not be enough because the agent can often find an alternative route that still achieves the attacker’s goal. In the study, a blocked direct submission was bypassed by typing into a form and clicking Submit. Effective controls must account for follow-on steps, session history, and other permitted tool paths.
Why the first blocked action is not enough
agent workflow are rarely one-step paths. If a policy only stops the first bad action, the same goal can often be reached through a different sequence that is still permitted by the surrounding workflow. That is why control design has to look at the outcome the agent is pursuing, not just the first disallowed command.
The practical issue is substitution. An attacker or misused agent does not need the exact blocked step if the workflow still allows a later form submit, a different tool call, a retry, or a state change that reaches the same end result.
How policy bypass happens inside an agent workflow
In agentic systems, a decision to block one action may leave the agent free to continue with adjacent steps that preserve intent. The example in the source is a direct submission being blocked, then bypassed by typing into a form and clicking Submit. The control failed because it watched a single verb, not the full transaction.
This pattern shows up when policy is attached to one command, one UI event, or one API call, while the real risk sits in the combination of steps. If the agent can preserve session state, reuse prior context, or invoke another allowed tool, the workflow can still complete.
What effective controls need to understand
Good controls need to evaluate the whole chain: what the agent is trying to achieve, which intermediate steps are allowed, and which state transitions are still possible after the first block. The most useful boundary is usually the transaction, session, or task objective, not the first visible action.
That means policy has to be aware of follow-on actions, contextual history, and alternate paths that are functionally equivalent. A narrow deny rule can reduce one expression of abuse while leaving the underlying capability untouched.
Risk and Threat Considerations
The core risk is false confidence. A control that blocks only the first bad action can still leave the agent able to complete the same harmful outcome through a different permitted path, especially when the workflow spans multiple steps or tools.
Failure mechanism: The policy is enforced at the step level instead of the workflow level, so alternative inputs, later steps, or retained session state allow the same objective to be achieved.
Impact: Attackers can bypass the apparent safeguard, complete unauthorized actions, and exploit the gap between what was denied and what remains reachable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Agent workflows can reach harmful outcomes through alternate allowed tool paths. |
| ASI03 — Identity & Privilege Abuse | A blocked step can still succeed if the agent retains authority across later workflow steps. | |
| ASI09 — Human-Agent Trust Exploitation | The issue is overtrusting one visible safeguard while the agent continues via another route. | |
| Recommendation — Constrain tool access by task and verify that blocked steps cannot be reattempted through alternate tools. Bound agent authority so one denied action cannot be completed through preserved privileges or context. Design controls that validate the full workflow outcome, not only the first denied interaction. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Limiting what the agent can do reduces the chance that an alternate path still reaches the goal. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Workflow-level logging is needed to spot bypasses that succeed after the first block. | |
| Recommendation — Restrict agent permissions to the smallest set needed for the task outcome. Review agent activity logs for successful alternate paths after a denied action. | ||
| OWASP ASVS | V8 — Authorization | Authorization must cover the full action sequence, not only the first denied control point. |
| V16 — Security Logging and Error Handling | Evidence of alternate-path completion is needed to detect when a first-block policy is bypassed. | |
| Recommendation — Verify that authorization decisions cover each meaningful workflow step and state transition. Log denied and successful follow-on actions to expose workflow bypass patterns. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity and Access Management Access Permissions | Access permissions must be aligned to the full permitted task path, not a single action. |
| DE.CM-09 — Monitoring for Anomalies | Monitoring should detect when a blocked action is followed by a successful alternate route. | |
| Recommendation — Align access permissions to the complete workflow so alternate allowed steps do not preserve abuse paths. Watch for denied actions followed by equivalent successful steps in the same session. | ||
Practitioner Guidance
What to verify: Test the full path, not just the blocked step. If an action can be reached through a different input method, a later tool call, or a preserved session context, the policy is too narrow.
Decision rule: If the agent can still accomplish the same objective after one deny decision, treat the control as incomplete and redesign the policy around the task outcome or permitted workflow state.
Common mistake: Teams often stop at the first successful block and assume the workflow is protected. In practice, that only proves one route was denied, not that the goal was prevented.
Practitioner takeaway: The right question is not “did we block the first bad action?” but “did we block the attacker’s ability to finish the workflow by any allowed route?”
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
