They fail where the action actually happens. Gateways mostly inspect traffic between systems, and guardrails mostly inspect prompts and responses, but agents make risk materialise through tool calls, repository changes, data access, and delegated actions. If those layers are not governed directly, the organisation is watching the conversation while the damage happens elsewhere.
Why gateways and guardrails stop at the edge of the problem
Traditional AI gateways and prompt guardrails are built to inspect a narrow slice of the system boundary. That works for chat-like interactions, but agentic systems turn the important security decision into an execution problem, not a text problem. Once an agent can call tools, change code, move data, or act through delegated authority, the real control point shifts downstream from the conversation layer.
The practical gap is that the organisation may still see the request and response, while the consequential action happens in a repository, SaaS app, cloud account, ticketing system, or workflow engine. In other words, the inspection surface is upstream of the blast radius.
Which agent behaviours escape prompt-centric controls
Prompt filtering is useful for blocking obvious unsafe instructions, but it does not govern what an agent is allowed to do after the prompt is accepted. Tool invocation, connector use, background jobs, environment variables, file writes, API requests, and delegated sessions all create action paths that are invisible if you only evaluate the text exchange.
This is why agentic failure often looks like benign conversation until the system executes a tool call with too much authority. The risk is not just malicious prompts, it is unauthorized or over-broad action taken by a system that has already been trusted to proceed.
When an agent can chain decisions across multiple systems, the failure mode becomes cumulative. A single prompt may not be dangerous on its own, but the combination of permissive tools, broad access, weak approval gates, and reusable credentials can make the end state materially unsafe.
What governance has to cover instead
Security needs to govern the agent’s action surface directly: which tools it may call, which data it may read or write, which identities it can use, and which requests require step-up approval. That means controlling delegated authority, session scope, repository permissions, connector policy, and action-level authorization rather than treating the model interface as the primary control boundary.
For teams building discovery and governance around this problem, the right starting point is usually Agentic AI Security Guide, because it frames the layered controls around inputs, memory, tools, orchestration and identity. The question is not whether the model can be filtered, but whether the agent can be constrained before it reaches a sensitive action.
That also means visibility has to extend beyond prompts. If you cannot attribute tool use, distinguish intended from unintended actions, or revoke the agent’s active access quickly, you do not have governance, you have observability theatre. The operational unit of control is the action, not the sentence.
Risk and Threat Considerations
Agentic systems expose a different attack surface from ordinary chat interfaces because a successful influence on the agent can produce real-world side effects, including data exfiltration, unauthorized changes, or misuse of connected services. The most serious failures happen when the system assumes the model layer is the control plane, while the actual privilege sits in the tool, connector, or delegated session.
Failure mechanism: The agent is allowed to translate an accepted request into privileged actions without per-action authorization, scoped credentials, or tight isolation between tasks and environments.
Impact: A single compromised interaction can become a repository modification, data access event, workflow execution, or external transaction that is harder to detect and undo than a blocked prompt.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic failure here centers on excessive delegated authority and unsafe action paths. |
| ASI02 — Tool Misuse | The core problem is unsafe tool invocation after prompts are accepted. | |
| Recommendation — Enforce per-action authorization and least privilege for agent tool use. Restrict and validate tool calls before the agent can execute them. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Agent access must be narrowed to the minimum authority needed for each task. |
| AU-12 — Audit Generation | Action-level visibility is needed because prompt logs alone miss consequential behaviour. | |
| Recommendation — Limit every agent credential and connector to the minimum required access. Log agent tool actions, data access, and delegated requests at execution time. | ||
| NIST Zero Trust (SP 800-207) | 0 — Zero Trust principles | The answer depends on verifying each request and removing implicit trust in the model layer. |
| Recommendation — Verify each agent request continuously instead of trusting the session boundary. | ||
Practitioner Guidance
What to prioritise: Put policy around tool execution and delegated access before you tune prompt filters. If the agent can touch production data or write to shared systems, make action approval and scope limits the default, not an exception.
What to verify: Check whether each tool, connector, and session is separately authorized, logged, and revocable. If the only audit trail is the prompt transcript, you do not yet have adequate control over agentic behaviour.
Common mistake: Treating “safe output” as equivalent to “safe execution.” A harmless-looking answer can still trigger a dangerous tool call, so governance must be attached to the act, not just the language.
Practitioner takeaway: The decisive control in agentic environments is not the gateway at the conversation boundary, it is the policy layer that constrains what the agent can do after the conversation is over.
Related resources from NHI Mgmt Group
- Guide: Shadow AI and AI Agent Discovery Guide
- How should security teams govern machine identity credentials in agentic AI environments?
- When does just-in-time access reduce risk for agentic AI, and when does it fall short?
- How does the rise of AI identities impact traditional IAM systems?
- Why do AI agents create a different access-risk profile than traditional applications?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org