Authorized-step composition is the failure mode where individually permitted actions combine into an unsafe outcome. It matters for agentic systems because security can break even when each step appears valid, which means governance has to evaluate the whole sequence.
What Authorized-Step Composition Means in Agentic Systems
Authorized-step composition describes a sequence-level failure, not a single bad permission. Each step may be individually allowed, yet the combined path still produces an unsafe result because the system only checked local validity instead of the whole action chain.
This matters most in agentic systems where an agent can plan, call tools, pass intermediate state forward, and keep acting across multiple turns. The risk is that every step looks compliant in isolation while the overall objective crosses a policy boundary, creates an unintended side effect, or reaches a forbidden outcome.
Why Individually Safe Actions Can Become Unsafe Together
The core problem is composition. A tool call that is acceptable on its own can become dangerous when paired with later calls that reuse context, widen scope, or transform a benign action into something irreversible. The security model must therefore reason about the sequence, not just the permission attached to each action.
Authorized-step composition often appears when systems assume that “allowed” at one step means “safe overall.” That assumption breaks down when an agent can combine retrieval, escalation, write actions, approvals, or external side effects into an end state the policy never intended to permit.
Governance Implications for Agentic Workflows
Governance has to move from single-action approval to sequence-aware control. That means defining what a safe trajectory looks like, what intermediate states are acceptable, and which combinations of valid steps still require human review or additional policy checks.
This is especially important when the agent can act across multiple tools or environments, because authority often accumulates gradually. A single action may be low risk, but a chain of low-risk actions can still create privilege expansion, data exposure, or irreversible operational change.
Practical governance also needs ownership. Someone has to decide whether the control boundary sits at the tool, the step, the task, or the full workflow, because ambiguity at that layer is where authorized-step composition usually survives.
How to Recognise the Failure Mode in Practice
Look for systems that validate each call independently but never re-evaluate the full plan before execution continues. The warning sign is a workflow where approval, policy, or guardrails are applied locally, yet the final outcome is never compared against the original intent or the broader safety constraint.
Another signal is hidden dependency between steps, where the safety of step two depends on what step one already changed. In those cases, the system may be technically correct at each checkpoint while still being strategically unsafe overall.
Risk and Threat Considerations
Authorized-step composition creates a real abuse path because it lets an attacker, or a poorly constrained agent, assemble a harmful outcome from actions that individually look legitimate. That makes it harder for defenders to spot misuse early, especially when monitoring is focused on single events rather than the full execution path.
Failure mechanism: Policy checks approve each step in isolation, but the cumulative sequence crosses a trust, privilege, or safety boundary that no single action would have crossed alone.
Impact: The result can be unauthorized data exposure, unintended system changes, privilege amplification, or a dangerous automated action that appears compliant at the point of execution.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Sequence abuse can steer an agent from permitted steps to an unsafe end state. |
| ASI02 — Tool Misuse | Authorized-step composition often emerges when individually allowed tool calls combine unsafely. | |
| ASI03 — Identity & Privilege Abuse | Composed steps can accumulate authority beyond what any single action should allow. | |
| Recommendation — Constrain task objectives so step-by-step execution cannot drift into unsafe goals. Gate tool use by task context and recheck the full action sequence before execution continues. Limit delegated authority so no valid step can cumulatively expand privilege into a harmful outcome. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege limits what each step can do, reducing harmful sequence composition. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-execution review must reconstruct the whole chain, not isolated permitted steps. | |
| IA-5 — Authenticator Management | If compromised credentials drive the sequence, controlling lifecycle and reuse limits abuse potential. | |
| Recommendation — Apply least privilege so each action exposes only the minimum authority needed. Review audit trails for end-to-end action chains and investigate unsafe cumulative effects. Manage credential lifecycle tightly so stolen or reused secrets cannot sustain multi-step abuse. | ||
Practitioner Guidance
Why practitioners should care: Sequence-level safety is the real control problem here, not just per-call authorization. If your workflow design cannot explain why the whole path is safe, then local approval checks are not enough.
What to watch for: Treat multi-step agents, chained tool use, and stateful workflows as distinct from ordinary request handling. The more an action depends on prior steps, the more important it becomes to evaluate intent, cumulative effect, and final outcome together.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org