Why do agentic AI systems need more than static prompts and model defaults?

Why This Matters for Security Teams

Static prompts and model defaults were designed to shape output, not to govern autonomous execution. Once an agent can plan, call tools, and carry state across sessions, the security problem shifts from prompt quality to runtime control of identity, permissions, and impact. That is why guidance such as the OWASP Agentic AI Top 10 and NIST AI Risk Management Framework focuses on governing behavior at the moment of action, not only at the moment of prompt submission.

The operational risk is simple: an agent can be “well prompted” and still misuse a token, chain a tool call, or expose data outside its intended scope. NHIMG research on the AI Agents: The New Attack Surface report shows why this matters in practice, with 80% of organisations reporting agents have already performed actions beyond their intended scope. In practice, many security teams discover the failure only after the agent has already accessed data, touched a system, or shared something it should never have reached.

How It Works in Practice

Effective governance for agentic systems starts by treating the agent as a workload with its own identity, not as a user that can be controlled by a longer system prompt. Current best practice is evolving toward runtime authorization, ephemeral credentials, and policy evaluation based on intent and context. That means the system checks what the agent is trying to do, what data it is touching, which tool it is invoking, and whether the requested action is appropriate right now.

In practical terms, teams usually combine four controls. First, they issue short-lived secrets or tokens per task rather than relying on long-lived credentials. Second, they bind the agent to workload identity so the platform can prove what the agent is, not just what password it knows. Third, they enforce policy-as-code at request time, using controls that can inspect action, resource, and risk context before execution. Fourth, they log every tool call and data access path so incident response can reconstruct what happened.

• Static prompts can reduce some unsafe outputs, but they do not reliably prevent lateral movement or chained actions.
• JIT credentialing reduces blast radius because access expires when the task ends.
• Workload identity frameworks such as SPIFFE and SPIRE help separate agent identity from human identity assumptions.
• Runtime policy engines are more appropriate than prewritten role maps when behaviour changes from one task to the next.

This aligns with NHIMG guidance in the OWASP NHI Top 10 and is consistent with the control philosophy in the CSA MAESTRO agentic AI threat modeling framework. These controls tend to break down when agents are allowed to operate across loosely governed SaaS tools, because context is lost between systems and no single policy layer sees the full action chain.

Common Variations and Edge Cases

Tighter runtime controls often increase integration overhead, requiring organisations to balance agility against the cost of orchestration and policy maintenance. That tradeoff becomes more pronounced in multi-agent workflows, where one agent delegates to another and the resulting chain of custody is harder to follow. There is no universal standard for this yet, so guidance should be treated as evolving rather than final.

Some environments still rely on prompts as a first-line safeguard because they are easy to deploy, but that approach is weakest where the agent can access external tools, customer data, or production systems. If the model is used only for bounded text generation, prompts may be adequate for basic content shaping. Once the system can act, however, prompt-only governance is not enough. NHIMG cases such as the CoPhish OAuth Token Theft via Copilot Studio and Amazon Q AI Coding Agent Compromised show how quickly tool access becomes the real attack surface.

For that reason, security teams should distinguish between content safety, action safety, and identity safety. Prompts influence content. Policy governs action. Identity and secrets control who or what is allowed to act. When those layers are collapsed into one prompt, the organisation inherits hidden risk that only appears after the agent has already made a consequential decision.

Related resources from NHI Mgmt Group

• Why do agentic AI systems increase the risk of hidden blast radius and lateral impact?
• When does just-in-time access reduce risk for agentic AI, and when does it fall short?
• How should security teams govern machine identity credentials in agentic AI environments?
• Why is identity such a critical factor in securing AI agent systems?