Agent capabilities are the tools, commands, and actions an AI agent is allowed to use. This includes whether it can read files, write records, send messages, or modify infrastructure. The more powerful the toolset, the larger the potential blast radius if the agent is misled, compromised, or misconfigured.
Expanded Definition
Agent capabilities are the specific permissions and action paths an AI agent can exercise through tools, APIs, workflows, and system commands. In NHI security, the term is about execution authority, not model quality: a capable model with tightly scoped tools can be safer than a modest model with broad write access. Industry usage is still evolving, but most practitioners treat capabilities as the operational boundary between inference and impact.
That boundary matters because agent capabilities often span reading data, writing records, sending messages, creating tickets, calling infrastructure APIs, or invoking privileged automation. The NIST AI Risk Management Framework emphasizes governing an AI system’s effects, and capability design is one of the clearest ways to do that in practice. A strong program separates routine read-only actions from state-changing actions, then layers approvals, logging, and revocation around the latter.
For NHI teams, capability scope should be reviewed like any other privileged entitlement, especially when an agent can reach secrets, production systems, or identity workflows. The most common misapplication is granting broad tool access to “make the agent useful,” which occurs when teams skip capability scoping during rapid deployment.
Examples and Use Cases
Implementing agent capabilities rigorously often introduces friction, because every additional write path, approval step, or sandbox boundary reduces speed while improving containment.
- A support agent can read a knowledge base and draft replies, but it cannot send messages without human approval, reducing the chance of accidental disclosure.
- An infrastructure agent can inspect cloud resources and propose remediation, but changes to production require a separate privileged workflow with logging and rollback.
- A finance agent can prepare reimbursement records, while only a designated approver can commit payments or modify ledger entries.
- An admin agent can rotate credentials in a vault, but only within a constrained set of namespaces and only after policy validation, reflecting lessons from the Moltbook AI agent keys breach.
- A coding agent may open pull requests and run tests, but it cannot deploy directly to production, a pattern that aligns with the control thinking in the OWASP Agentic AI Top 10 and NHIMG’s OWASP NHI Top 10 coverage.
These use cases show why capability design is less about what the agent can “know” and more about what it is allowed to do in the environment.
Why It Matters in NHI Security
Agent capabilities define blast radius. If a prompt injection, poisoned tool call, or stolen token reaches an overpowered agent, the result is often not just bad output but unauthorized action. That is why NHIs linked to agent workloads are especially sensitive: capability scope becomes the difference between a contained incident and a systemic compromise. NHIMG reports that 97% of NHIs carry excessive privileges, which broadens the attack surface and makes capability review a core control rather than a nice-to-have.
Capability governance also supports Zero Trust thinking. The NIST AI Risk Management Framework and the CSA MAESTRO agentic AI threat modeling framework both reinforce the idea that trust should be conditional, monitored, and limited by context. In practice, capabilities should be mapped to least privilege, separated by environment, and reviewed whenever the agent’s role changes. NHIMG’s broader NHI research also shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which makes overbroad agent authority a direct security concern.
Organisations typically encounter agent capability failures only after a destructive action, at which point capability scoping becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Agent capability scope is central to OWASP guidance on tool use and action boundaries. | |
| OWASP Non-Human Identity Top 10 | NHI-02 | Overpowered agent tools increase secret exposure and misuse risk under NHI control guidance. |
| NIST AI RMF | NIST AI RMF frames AI system governance around managing impact, harm, and operational risk. | |
| NIST Zero Trust (SP 800-207) | Zero Trust requires explicit authorization and continuous verification for every agent action. | |
| CSA MAESTRO | MAESTRO addresses agentic workflows, tool permissions, and threat modeling for autonomous actions. |
Limit tool access, add approvals for writes, and continuously test whether the agent can exceed its intended action scope.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
