The security risk that emerges from combining individually acceptable components into an unsafe end-to-end workflow. In MCP and agentic environments, the danger is often not a broken server but a delegation path that lets untrusted input influence privileged action.
Expanded Definition
Compositional risk describes the security failure mode that appears only when safe-looking pieces are chained together into a complete workflow. In agentic and MCP-based systems, each individual tool, policy, or credential may appear acceptable in isolation, yet the combined delegation path can still allow untrusted input to trigger privileged action. This is why compositional risk is broader than a single misconfiguration: it is about interaction effects, trust propagation, and hidden assumptions between components.
Definitions vary across vendors, but the core idea aligns with established security thinking in NIST Cybersecurity Framework 2.0 and with zero trust principles that assume no component should inherit trust automatically from the last one. NHI Management Group treats this as a design-time and run-time governance issue, especially where agents can call tools, retrieve secrets, or chain actions across services. It is not enough to certify each element as secure; the end-to-end path must also be constrained, observable, and revocable. The most common misapplication is treating a safe component inventory as proof that the assembled workflow is safe, which occurs when teams review modules separately but never test the delegation chain under adversarial input.
Examples and Use Cases
Implementing controls against compositional risk often introduces workflow friction, requiring organisations to weigh automation speed against tighter approval, scoping, and monitoring boundaries.
- An AI agent uses MCP to query a ticketing system, then a separate approval tool, and finally a deployment action. Each step is allowed, but the sequence lets attacker-supplied text become an unintended production change.
- A service account can read prompts, access a secrets store, and invoke a cloud API. None of those permissions look excessive alone, but together they create an escalation path that bypasses intent controls.
- A retrieval workflow combines public web data with internal policy text. If prompt injection alters the context, the agent may follow unsafe instructions even though the data source and model are each individually trusted. See the OWASP NHI Top 10 for the broader agentic risk landscape.
- In a CI/CD pipeline, an automation identity can read build artifacts, fetch signing material, and publish releases. Compositional risk emerges when a low-trust artifact influences a high-trust release step.
- The Top 10 NHI Issues and NIST SP 800-53 Rev 5 Security and Privacy Controls are useful reference points when mapping component-level access to end-to-end authorisation boundaries.
Why It Matters in NHI Security
Compositional risk is one of the main reasons NHI incidents become hard to detect and harder to contain. A workflow may look compliant at the credential layer while still enabling unsafe delegation through excessive permissions, weak context separation, or missing step-level authorization. That matters in NHI environments because identities are often machine-speed, long-lived, and deeply interconnected across APIs, automation tools, and agentic systems. NHI Management Group has found that 97% of NHIs carry excessive privileges, which means seemingly routine chains can quickly become high-impact paths when trust is composed rather than bounded.
This is also why governance cannot stop at inventory and rotation. The Ultimate Guide to NHIs — Key Challenges and Risks and Ultimate Guide to NHIs — Why NHI Security Matters Now show that visibility gaps and overly broad access remain common, which increases the chance that a composed workflow will fail in production. Organisations typically encounter compositional risk only after an agent, service account, or automation chain has already executed an unintended action, at which point the unsafe interaction path becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Agentic risk often arises from unsafe tool chaining and delegated actions. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Compositional risk grows when NHI permissions combine into unsafe workflows. |
| NIST CSF 2.0 | PR.AC-4 | Least privilege and access governance reduce hidden privilege composition. |
| NIST Zero Trust (SP 800-207) | 4.1 | Zero Trust requires explicit verification at each interaction, not inherited trust. |
| NIST SP 800-63 | Identity assurance concepts help frame delegated trust in machine workflows. |
Apply strong assurance and reauthentication where automation performs sensitive actions.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
