They often secure the model and ignore the runtime. The model is only one component. The real risk sits in the orchestration layer that decides what tools can be called, what data can be reached, and whether actions are approved, recorded, and attributable.
Why This Matters for Security Teams
The common mistake is treating an LLM-based agent like a normal application with a smarter interface. That framing misses the real identity problem: an agent can choose tools, chain actions, and request data at runtime, so its access pattern is not stable enough for static RBAC alone. Guidance from the OWASP Agentic AI Top 10 and NIST’s NIST AI Risk Management Framework both point to the same issue: the runtime decision path, not the model weights, determines most security exposure.
That is why identity, authorization, and audit need to move with the action, not sit only around the model endpoint. In agentic systems, the orchestration layer is where approvals are made, secrets are handed out, and accountability is either preserved or lost. NHIMG research on AI Agents: The New Attack Surface report shows how quickly agent behavior can exceed intended scope, which is consistent with broader observations in LLMjacking: How Attackers Hijack AI Using Compromised NHIs. In practice, many security teams encounter unauthorized tool use only after the agent has already acted, rather than through intentional control testing.
How It Works in Practice
Teams get better outcomes when they treat the agent as a workload with a runtime identity, not as a user and not as a static service account. Current practice is moving toward workload identity, short-lived tokens, and policy evaluation at request time. In mature patterns, the model proposes, the orchestration layer evaluates context, and the policy engine decides whether the action can proceed. That distinction matters because the same agent may be allowed to summarize a document, denied access to a vault, and issued a one-time secret for a narrowly scoped task.
Operationally, this usually means combining:
- Workload identity for the agent process, often with cryptographic proof such as OIDC or SPIFFE-style identities.
- Just-in-time credential issuance with short TTLs so secrets expire after the task completes.
- Context-aware authorization that checks intent, data sensitivity, destination, and tool risk at runtime.
- Full logging of prompts, tool calls, approvals, and data reads so actions are attributable.
That approach aligns with the direction of the CSA MAESTRO agentic AI threat modeling framework and the OWASP NHI Top 10, both of which emphasize that identity and tool access must be controlled where the action happens. NHIMG’s Moltbook AI agent keys breach is a useful reminder that exposed or overlong credentials become a direct path from model output to real-world damage. These controls tend to break down when agents are allowed to operate across many SaaS systems with weak event correlation because no single system sees the full sequence of chained actions.
Common Variations and Edge Cases
Tighter control often increases latency and operational overhead, requiring organisations to balance agent autonomy against approval friction and engineering complexity. There is no universal standard for this yet, so best practice is evolving rather than settled. Some teams use pre-approved action sets for low-risk workflows, while others require human approval for any step that reaches production data, financial systems, or secret stores.
The hardest edge cases appear when an agent is long-running, multi-step, or delegated across multiple tools. A permission model that works for one API call can fail when the agent needs to retrieve data from one source, transform it, and then write to another. That is where static role definitions become too coarse. The more resilient pattern is to re-evaluate authorization at each meaningful step, revoke credentials immediately after use, and separate read, write, and execution privileges. NIST AI RMF and NIST AI 600-1 Generative AI Profile both support this kind of governance discipline.
High-autonomy systems also create blind spots for compliance and incident response. NHIMG’s 52 NHI Breaches Analysis and the Ultimate Guide to NHIs both reinforce a practical point: when identity is not bound to runtime behavior, attribution fails first, then containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Covers agent runtime risk where tool use and autonomy create exposure. |
| CSA MAESTRO | Models identity, orchestration, and guardrails for autonomous agents. | |
| NIST AI RMF | Provides governance for AI system risk, accountability, and monitoring. | |
| OWASP Non-Human Identity Top 10 | NHI-03 | Relevant to short-lived secrets and rotation for agent workloads. |
| NIST Zero Trust (SP 800-207) | SC-7 | Supports continuous verification and least privilege for agent actions. |
Map agent actions to runtime controls and block tool calls that exceed approved intent.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
