Which frameworks should organisations use to manage risk in the agentic workspace?

Why This Matters for Security Teams

agentic workspace change the risk profile because software now has execution authority, can call tools, and can act on data at machine speed. That makes the right framework choice a governance issue, not just a tooling decision. Security teams need a common language for accountability, boundary setting, and evidence of control operation. The most useful starting points are NIST AI Risk Management Framework for governance and OWASP Agentic AI Top 10 for concrete failure modes.

The mistake many organisations make is treating the agent as a chatbot problem and leaving ownership split across AI, security, and platform teams. In practice, that creates gaps in approval, logging, escalation, and kill-switch design. The better approach is to map agent behaviour to existing control families such as data protection, privileged access, and detection engineering, then add AI-specific controls where autonomy introduces new risk. Current guidance suggests this is most effective when the framework choice reflects both model risk and operational impact, not just compliance labels. In practice, many security teams encounter agent misuse only after data exposure or unsanctioned actions have already occurred, rather than through intentional governance.

How It Works in Practice

Framework selection for the agentic workspace works best as a layered model. Start with NIST Cybersecurity Framework 2.0 to anchor outcomes for identify, protect, detect, respond, and recover. Then use NIST AI Risk Management Framework to govern model and agent risks such as misuse, opacity, unsafe autonomy, and weak human oversight. For threat modelling, pair that with MITRE ATLAS adversarial AI threat matrix, which helps teams reason about prompt injection, data poisoning, tool abuse, and inference-time manipulation.

Practically, organisations should translate those frameworks into control objectives that fit agent workflows:

• Define where agents may act autonomously and where approval is required.
• Restrict tool access, API scopes, and data access to the minimum necessary.
• Log prompts, tool calls, outputs, and state changes for review and investigation.
• Validate outputs before action when the agent can affect customers, money, or production systems.
• Test failure modes such as prompt injection, malicious memory content, and indirect data exfiltration.

For teams building controls from the ground up, NIST SP 800-53 Rev 5 Security and Privacy Controls remains the most practical control catalogue for mapping technical safeguards to governance requirements. Best practice is evolving, but the pattern is clear: use NIST to structure governance, OWASP to test agent-specific weaknesses, and MITRE to simulate credible adversarial behaviour. These controls tend to break down when agent privileges are embedded in legacy automation pipelines without clear ownership, because accountability and telemetry are fragmented across systems.

Common Variations and Edge Cases

Tighter agent governance often increases delivery overhead, requiring organisations to balance autonomy and speed against review, logging, and approval costs. That tradeoff is especially visible in high-change environments, where teams want agents to assist with operations, code, or service workflows without slowing execution.

There is no universal standard for this yet, so framework choice should reflect use case and risk tolerance. For example, regulated organisations may prioritise control mapping through NIST Cybersecurity Framework 2.0 and NIST AI Risk Management Framework, while security research teams may lean more heavily on OWASP Top 10 for Agentic Applications 2026 and CSA MAESTRO agentic AI threat modeling framework for design reviews.

The identity intersection matters when agents inherit human credentials, impersonate users, or operate through shared service accounts. In those cases, current guidance suggests applying privileged access discipline, session boundaries, and strong auditability rather than assuming the agent is just another application. The main edge case is rapid experimentation, where shadow agents, unmanaged plugins, and ad hoc data connectors create blind spots faster than policy can catch up.

Related resources from NHI Mgmt Group

• What frameworks should organisations use to assess agentic AI risk?
• What frameworks should organisations use to reduce hidden identity risk?
• What frameworks should teams use to assess agentic identity risk?
• What breaks when organisations only use password policy to manage credential risk?