The failure is not simply hallucination. The real problem is that an autonomous agent can turn a suggestion into an action, then keep adapting until it finds a permitted path. Without execution controls, security teams lose the ability to stop code generation, tool invocation, or system changes before impact occurs.
When an autonomous agent can move from suggestion to execution
Execution controls are the difference between an AI system that can recommend and one that can materially change state. Once an agent has tool access, the risk is not limited to poor output quality; it can create, modify, delete, exfiltrate, or escalate through the systems it is allowed to touch. That is why governance has to focus on execution boundaries, not just prompt quality or model accuracy. NIST’s AI Risk Management Framework is useful here because it frames AI risk as a lifecycle and governance problem, not a single-model issue. NIST AI Risk Management Framework In practice, many security teams only discover the missing boundary after an agent has already been allowed to act through an apparently harmless integration.
What execution controls actually stop in practice
Execution controls place a gate between an agent’s intent and the side effects that follow. The question is not whether the model can reason about a task, but whether the surrounding system can verify, constrain, and record each action before it is committed. That is why allowlisting, scoped permissions, approval thresholds, and transaction logging matter more than generic “human in the loop” language. A human review step that is bypassed by orchestration logic is not a real control.
In practical terms, teams should think about four separate layers:
- what the agent may attempt, such as tool calls, code generation, API requests, or configuration changes;
- what the runtime may permit, based on identity, scope, environment, and policy;
- what must be reviewed before effect, such as high-risk actions or irreversible changes;
- what is recorded for audit, including the prompt, decision path, tool invocation, and resulting state change.
OWASP’s agentic guidance is relevant because it focuses on the ways autonomous systems turn access into impact, including overbroad tool use and uncontrolled action paths. OWASP Top 10 for Agentic Applications 2026 The operational point is simple: if an agent can retry, rephrase, or route around a failed request until it finds an allowed path, then the control surface is in the wrong place. Execution controls fail most often when they are bolted onto the interface rather than enforced at the point of action.
Where this guidance breaks down is in environments that grant broad delegated access to many downstream systems, because policy can become so fragmented that no single control point reliably sees the full consequence of an agent’s action.
Where organisations usually misread the boundary
Tighter execution control often adds latency and workflow friction, so organisations have to balance agent autonomy against the cost of review, exception handling, and operational delay.
One common mistake is to treat all agent actions as equal. In reality, a read-only lookup, a draft response, and a production configuration change have very different risk profiles. Another is to rely on the model to “know better” when it should stop. That is not a control; it is an assumption.
The edge cases are usually governance edge cases rather than model edge cases. If an agent can chain multiple low-risk calls into a high-risk outcome, the controls must be evaluated at the transaction level, not just per call. If an agent is allowed to invoke external tools, the organisation also needs clear rules for which systems can receive those calls and which outputs can be acted upon automatically. This is where execution controls overlap with identity and privilege: the agent’s authority must be bounded in the same way any other privileged actor is bounded, but with even tighter constraints because the behaviour is adaptive.
Industry consensus is still forming on the best balance between autonomy and control for agentic systems, but there is broad agreement that uncontrolled execution is not an acceptable production default. The safer pattern is to permit constrained action, require explicit approval for irreversible effects, and make every high-impact step attributable to a named owner and policy.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATLAS, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Directly addresses uncontrolled agent actions and tool use. |
| Recommendation: Agent authority must be bounded before an action can change systems. | ||
| NIST AI RMF | GOVERN | Frames agent execution as a governance and lifecycle risk. |
| Recommendation: Autonomous action needs defined oversight, accountability, and risk ownership. | ||
| MITRE ATLAS | T0001 | Agentic systems can be steered into unsafe execution paths. |
| Recommendation: Attackers may manipulate an agent into taking harmful tool actions. | ||
| CSA MAESTRO | TRM-01 | Useful for modelling how agent tools become impact paths. |
| Recommendation: Execution risk should be modelled around agent actions and system effects. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 | Agent execution often depends on token and secret scope. |
| Recommendation: Overbroad credentials can turn agent autonomy into unintended access. | ||
Risk and Threat Considerations
An agent with unchecked execution rights can be steered, prompted, or simply allowed to continue until it finds a permitted path to a harmful action. The material risk is not bad output alone, but uncontrolled side effects through tools, APIs, and privileged workflows.
Failure mechanism: The failure chain usually starts with excessive tool scope or weak policy enforcement, then continues through retries, chained actions, or indirect requests that bypass intent checks. Once the runtime does not enforce action-level limits, the agent can convert a low-trust instruction into a state-changing operation.
Impact: This can lead to unauthorised code execution, configuration drift, data exposure, or irreversible system changes before a human can intervene. It also weakens auditability because the organisation loses a clear boundary between recommendation, approval, and committed action.
Practitioner Guidance
Teams often over-invest in prompt safety and under-invest in runtime enforcement. The real control problem is not whether the agent seems trustworthy, but whether the system can prevent a trusted-looking action from becoming an irreversible one.
- Classify every agent tool and endpoint as read, draft, or execute, then block production execution by default unless the action is explicitly approved for that class.
- Bind each agent to a narrow execution identity with scoped permissions, and review any permission set that can reach production systems, secrets, or external side effects.
- Require a policy check at the moment of action, not just at prompt time, so retries, chained requests, and indirect tool calls cannot bypass the original approval decision.
- Log the prompt, tool call, policy decision, and resulting state change together so reviewers can reconstruct how a recommendation became an execution event.
- Set a hard stop for irreversible actions such as deletion, deployment, payment, or privilege changes, and require a named owner to approve those transitions.
Related resources from NHI Mgmt Group
- What breaks when agentic AI is allowed to remediate systems without tight controls?
- What breaks when AI assistants are allowed to act on untrusted email content without approval controls?
- What breaks when AI assistants are allowed to act on behalf of users without policy checks?
- How should security teams let agentic AI act without creating false remediation risk?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 4, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
