They assume time between stages, but agentic workflows compress design, build, and test into short loops. By the time a point-in-time review closes, the context may already have changed. Security teams need controls that operate continuously, not just at the next formal gate.
Why This Matters for Security Teams
Traditional SDLC checkpoints were built for work that moves in identifiable stages. Agentic development does not. Autonomous agents can draft code, call tools, run tests, open pull requests, and revise themselves in rapid cycles, which means the risk surface changes before a formal review can close. That is why point-in-time signoff often lags behind the actual state of the system.
Current guidance suggests treating agentic delivery as a continuously evolving operational workflow, not a sequence of isolated handoffs. The risk is not only defective code, but also unsafe tool use, prompt injection paths, credential exposure, and unexpected task chaining. NHIMG’s analysis of OWASP NHI Top 10 and the OWASP Agentic AI Top 10 shows why static checkpoints miss the runtime conditions that agents create and exploit. In practice, many security teams encounter scope drift only after an agent has already chained actions across systems, rather than through intentional release governance.
How It Works in Practice
Agentic development compresses design, implementation, validation, and deployment into a single control loop. A developer or platform team may approve a plan, but the agent can change the codebase, alter tests, re-run tools, and regenerate outputs before the next review window. That makes conventional stage-gate models too slow for the pace of change.
Better practice is to move from checkpoint thinking to runtime governance. The NIST AI Risk Management Framework and CSA MAESTRO agentic AI threat modeling framework both support continuous risk treatment rather than one-time assurance. In practical terms, that means:
- evaluating agent actions at request time, not only at merge time;
- scoping tool access to the smallest task-specific permission set;
- issuing short-lived credentials for the exact workflow step, then revoking them;
- logging tool calls, prompts, and outputs together so reviewers can reconstruct the full decision path;
- blocking high-risk actions unless policy, context, and approval all align.
NHIMG’s Analysis of Claude Code Security is a useful reminder that coding agents are not just faster developers, they are active operators with real execution authority. Security teams should therefore treat CI/CD, prompt workflows, and agent toolchains as one control plane. These controls tend to break down when agents have broad repository access plus production-adjacent credentials because the agent can move faster than human review and chain benign steps into harmful ones.
Common Variations and Edge Cases
Tighter runtime control often increases friction, requiring organisations to balance release speed against assurance. That tradeoff becomes sharper in environments where agents are used for code generation, ticket triage, test execution, and deployment support in the same pipeline.
Best practice is evolving, but there is no universal standard for how much approval should be manual versus automated. In low-risk workflows, automated policy checks and sandboxed execution may be enough. In regulated or customer-facing systems, teams should add explicit human approval for privileged actions, time-bound access, and separation between build-time and deploy-time identities. Guidance from the NIST AI Risk Management Framework and the MITRE ATLAS adversarial AI threat matrix is especially relevant where agents can be manipulated through prompt injection or adversarial content.
NHIMG reporting on CoPhish OAuth Token Theft via Copilot Studio and Amazon Q AI Coding Agent Compromised shows that edge cases are often not classic software bugs, but trust-boundary failures between agent, tool, and identity layer. The standard checkpoint model breaks down when the agent can independently request new access, because the approval that was valid at the start of the task no longer reflects the state of the workflow at the end.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Agentic workflows create runtime risk that static SDLC gates miss. |
| CSA MAESTRO | T1 | MAESTRO frames threat modeling for autonomous agent execution paths. |
| NIST AI RMF | GOVERN | AI RMF governance supports continuous oversight for changing agent behavior. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Agent workflows depend on short-lived identities and secret hygiene. |
| NIST CSF 2.0 | PR.AC-4 | Least privilege is needed when agents can chain actions across tools. |
Map agent tasks, tools, and trust boundaries before permitting production access.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
