Defense in depth for agents is a layered security approach that combines deterministic policy controls with adaptive monitoring and response. It assumes no single safeguard is enough, because agents can bypass one layer and trigger another weakness. The model spreads coverage across build, deploy, run, and every action in between.
Expanded Definition
defense in depth for agents means placing multiple, independent control layers around an AI agent so that a single failure does not become a full compromise. In NHI and agentic AI environments, those layers typically span identity issuance, secret handling, tool permissions, prompt and action policy, runtime monitoring, and containment or rollback. The goal is not redundancy for its own sake, but failure isolation: if one control is bypassed, another layer should still reduce blast radius and preserve operator visibility.
This concept is closely related to the layered thinking used in NIST AI Risk Management Framework and the attack-pattern mapping in MITRE ATLAS adversarial AI threat matrix, but usage in the industry is still evolving because agentic systems vary widely in autonomy and tool scope. The practical distinction is that agent defense must cover both the model-facing path and the execution path, not just authentication at login. The most common misapplication is treating a single gateway, such as an approval step or a prompt filter, as complete protection when the agent still has broad runtime credentials and unchecked downstream tool access.
Examples and Use Cases
Implementing defense in depth for agents rigorously often introduces operational friction, requiring organisations to weigh faster automation against tighter approval and observability controls.
- An internal coding agent is allowed to propose changes, but a policy engine blocks destructive commands and a CI gate inspects the final diff before merge.
- A support agent can read customer records only through scoped, short-lived credentials, while session logging and anomaly detection watch for abnormal retrieval patterns.
- A procurement agent can draft purchase actions, but payment execution requires a separate human approval flow and a distinct service identity with limited privileges.
- A browser-using agent is sandboxed, restricted to approved domains, and monitored for prompt injection indicators, as discussed in OWASP NHI Top 10 and the external OWASP Top 10 for Agentic Applications 2026.
- A customer-facing agent is separated from privileged back-end tools, with escalation routes isolated so that one compromised conversation cannot reach admin systems, a pattern echoed in CoPhish OAuth Token Theft via Copilot Studio.
Why It Matters in NHI Security
Agents are attractive targets because they often combine persistent identity, delegated authority, and tool execution in one workflow. That makes weak layering especially dangerous: a leaked token, a permissive tool connector, or an unmonitored action path can turn a routine automation into a high-impact incident. NHI Mgmt Group research shows the scale of the problem: only 5.7% of organisations have full visibility into their service accounts, and 97% of NHIs carry excessive privileges, which means many agent deployments begin with an already fragile trust posture. This is why layered controls matter as a governance discipline, not just a technical preference. Strong agent defense should also reflect the control logic promoted by NIST AI Risk Management Framework and the threat coverage in OWASP Agentic AI Top 10 and Ultimate Guide to NHIs — 2025 Outlook and Predictions.
Organisations typically encounter the need for defense in depth only after an agent has already overreached, at which point containment, auditability, and rollback become operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Layered controls reduce secret exposure and privilege abuse across agent workflows. |
| OWASP Agentic AI Top 10 | A2 | Agentic app guidance emphasizes prompt, tool, and action abuse paths that need multiple safeguards. |
| NIST AI RMF | NIST AI RMF frames layered risk treatment for AI systems and their downstream impacts. | |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust requires continuous verification and segmenting agent access paths. |
| CSA MAESTRO | MAESTRO focuses on securing agentic workflows with layered control points and monitoring. |
Limit agent secrets, scope access tightly, and add monitoring so one missed control cannot expose everything.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
