Compound AI system

Expanded Definition

A compound AI system is not just a single model call with a prompt. It is an orchestrated workflow in which multiple models, agents, validators, routers, retrieval steps, or transformation stages jointly produce an outcome. That orchestration layer is often where security, reliability, and accountability decisions actually happen. In NHI and IAM practice, this matters because each step may use different credentials, scopes, trust assumptions, and logging paths.

Definitions vary across vendors, but the practical distinction is consistent: a compound system has more than one decision point, and those decision points can fail independently. A classifier may route a request, an LLM may draft a response, and a separate policy checker may approve or rewrite it. Governance therefore has to cover both the model behaviour and the control logic that connects them. For background on how NHI risk expands when automation chains are involved, see NHI Management Group’s discussion of the DeepSeek breach and the associated exposure of secrets in AI-adjacent workflows.

The most common misapplication is treating a multi-step AI workflow as a single model, which occurs when teams assign one security review to the final model call and ignore routing, memory, and tool-access controls.

Examples and Use Cases

Implementing a compound AI system rigorously often introduces more operational overhead, requiring organisations to weigh answer quality and automation depth against governance complexity and credential sprawl.

• A support assistant uses one model to classify intent, another to draft the answer, and a policy engine to redact sensitive details before release.
• An agentic coding workflow retrieves repository context, generates a patch, runs a verifier, then asks a separate model to explain the change for approval.
• A fraud workflow routes high-risk cases to a stronger model and low-risk cases to a cheaper one, which creates a security decision boundary that must be logged and reviewed.
• A retrieval-augmented assistant uses search, ranking, generation, and post-processing steps, each with distinct data exposure risks and secrets access paths.
• An internal operations bot invokes tools through chained service accounts, making NIST Cybersecurity Framework 2.0 style control mapping useful for tracing where trust is actually established.

These patterns show why a compound system is more than “LLM plus prompt.” The orchestration logic determines which identities, tokens, and policy checks are in play, so the security design must follow the workflow rather than the brand name of the model. Guidance in The State of Secrets in AppSec is relevant here because compound systems often multiply secret touchpoints across services and pipelines.

Why It Matters in NHI Security

Compound AI systems increase the number of places where an attacker can intercept, coerce, or abuse a credentialed action. If one step can call a tool, fetch context, or rewrite output, then every step becomes part of the attack surface. This is especially important for NHI governance because short-lived tokens, embedded API keys, service accounts, and delegated permissions can accumulate across workflow stages. NHI Management Group research shows that organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, and that fragmentation becomes more dangerous as automation chains expand.

Misunderstanding this term often leads to weak reviews that focus on model safety while ignoring identity safety. A compound system may pass a prompt injection review yet still leak data if the router, retriever, or post-processor can be influenced through a compromised NHI. For threat context, the credential abuse patterns discussed in LLMjacking: How Attackers Hijack AI Using Compromised NHIs show how quickly exposed credentials can be targeted once a workflow boundary is crossed.

Organisations typically encounter the operational impact only after a routing failure, secret leak, or tool misuse reveals that the orchestration layer was never governed, at which point compound AI system controls become operationally unavoidable to address.

Related resources from NHI Mgmt Group

• AI Agent Authentication
• Shadow AI
• When should organisations treat an AI agent as a privileged system?
• When should organisations treat an AI system as a non-human identity?