What should organisations review before expanding agentic delivery?

Why This Matters for Security Teams

Expanding agentic delivery is not just a scaling decision. It is a decision to increase the amount of work that can be done by software with tool access, data access, and execution authority. That changes the risk profile from controlled automation to potentially autonomous change-making, where a small policy gap can affect many systems at once. Current guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward the same issue: governance has to scale with capability, not with org chart assumptions.

Security teams often review model choice first and controls later, but agentic systems fail in the seams between prompts, tools, credentials, and approvals. NHIMG research on the OWASP NHI Top 10 shows why identity, secrets, and authorization are now core design questions, not implementation details. If an agent can discover a new path to a privileged action, expansion can turn a local defect into a broad operational incident. In practice, many security teams encounter that only after an agent has already touched production data or issued an unintended change.

How It Works in Practice

The right pre-expansion review should start with the agent’s actual blast radius. Map what it can read, what it can change, which tools it can call, and what approvals stand between a suggestion and a side effect. For agentic workloads, static RBAC alone is usually too blunt because the agent’s next action is not fully predictable at design time. Best practice is evolving toward context-aware authorization, short-lived credentials, and policy evaluation at request time.

Practically, that means checking six control areas together:

• Model access: confirm which models can see which data classes and whether prompts or retrieval paths cross trust boundaries.
• Credential custody: ensure secrets are not embedded in prompts, logs, or long-lived environment variables. NHIMG’s LLMjacking research shows how quickly exposed credentials can be abused once they are reachable.
• Intermediate quality checks: validate output before it becomes an action, especially for code, tickets, payments, or infrastructure changes.
• Traceability: preserve durable logs for prompts, tool calls, decisions, and approvals so investigators can reconstruct the chain of action.
• Cost controls: set spend limits, rate limits, and tool quotas to stop runaway loops or agent fan-out.
• Human authorization: require step-up review for actions that cross material thresholds, such as data export, deletion, or privilege escalation.

For identity, current guidance suggests treating the agent as a workload, not as a human user. That points to workload identity, ephemeral tokens, and just-in-time issuance rather than static shared secrets. Frameworks such as CSA MAESTRO agentic AI threat modeling framework and MITRE ATLAS adversarial AI threat matrix both reinforce the need to model how agents chain tools and privileges over time. These controls tend to break down when multiple agents share a common service account because attribution, revocation, and blast-radius containment all become ambiguous.

Common Variations and Edge Cases

Tighter pre-expansion controls often increase delivery overhead, requiring organisations to balance speed against the cost of review, instrumentation, and approval routing. That tradeoff becomes sharper in environments that rely on many small agents, delegated workflows, or rapid experimentation. There is no universal standard for this yet, but current guidance suggests that the higher the agent’s privilege, the lower the tolerance for loose governance.

One common edge case is the “low-risk pilot” that quietly inherits high-risk infrastructure access. Another is retrieval-augmented systems that appear read-only but can still leak sensitive context into downstream tools or shared memory. A third is multi-agent orchestration, where one agent’s approved action becomes another agent’s input, creating indirect privilege escalation. NHIMG’s AI Agents: The New Attack Surface report is a useful reminder that visibility gaps are already common before expansion begins.

For regulated or safety-sensitive workflows, review should also include rollback paths, kill switches, and explicit ownership for each tool integration. Where the system can alter records, trigger external actions, or access customer data, expansion should wait until the control chain is provably auditable. Guidance breaks down fastest in hybrid environments where legacy IAM, shared secrets, and autonomous tool use coexist without a single policy authority.

Related resources from NHI Mgmt Group

• Should organisations prioritise identity governance before expanding agentic AI?
• Should organisations prioritize securing machine identities before expanding agentic AI use?
• What should organisations review before adopting agentic API access controls?
• What should organisations review before expanding biometric analytics use?