The set of harmful or sensitive actions an AI agent can still complete after controls such as filtering, approval gates, and credential reduction have been applied. It is a practical measure of what remains possible under coercion, and it is more useful than raw attack success rates.
Expanded Definition
Residual Completable Capability describes the actions an AI agent can still carry out after defensive controls have been layered in. For NHI Management Group, the key idea is not whether a model can be prompted into misbehaviour in theory, but what it can still complete in practice when filters, policy checks, approval workflows, tool restrictions, and credential scoping are already in place. This makes the term especially useful in agentic AI security, where an agent may have execution authority, access to tools, and limited but still meaningful reach into systems.
The concept overlaps with control effectiveness, but it is narrower and more operational. It asks, “What harmful or sensitive outcome can still be completed end-to-end?” rather than “Was the prompt successful?” That distinction matters because an agent may fail many times and still retain enough permitted capability to exfiltrate data, alter records, or trigger workflows. Guidance across the industry is still evolving, so there is no single standard definition yet, but the logic maps well to NIST SP 800-53 Rev 5 Security and Privacy Controls when evaluating how access restrictions and monitoring reduce what remains achievable.
The most common misapplication is treating residual capability as a model-quality metric, which occurs when teams measure prompt resistance without checking whether the agent can still complete a harmful action through allowed tools or workflows.
Examples and Use Cases
Implementing Residual Completable Capability rigorously often introduces evaluation overhead, requiring organisations to weigh stronger assurance against slower release cycles and more complex test design.
- An AI support agent cannot directly send email attachments after filtering, yet it can still draft exfiltration-ready content that a connected workflow auto-sends once approved.
- A code-generation agent is blocked from raw shell access, but it can still create malicious pull requests if repository permissions and review paths are too broad.
- A procurement agent cannot approve payments outright, yet it can still prepare fraudulent vendor records that downstream automation finalises.
- An internal assistant has no direct database write access, but it can still expose sensitive records by querying a connected analytics tool that returns unrestricted fields.
- Security teams compare pre-control and post-control outcomes using the control structure in NIST SP 800-53 Rev 5 Security and Privacy Controls to identify which actions remain feasible after least-privilege changes.
Why It Matters for Security Teams
Security teams need this term because traditional AI red-teaming can overstate protection if it focuses on whether an attack prompt is blocked rather than whether the agent still has a path to complete damage. Residual Completable Capability shifts attention to the attack surface that survives real controls, including identity scope, tool permissions, approval chains, and the quality of downstream guardrails. That makes it directly relevant to NHI governance when agents hold credentials, tokens, or delegated access that can be used beyond the original intent of the deployment.
For practitioners, the practical question is whether a blocked path truly removes the outcome or merely reroutes it through another allowed mechanism. This is especially important in agentic AI systems that interact with enterprise applications, secrets, and workflow automation, where one weak integration can preserve meaningful residual capability even after front-end filtering. Organisations typically encounter the business impact only after an agent has already touched an unintended system or action, at which point Residual Completable Capability becomes the operational lens for containment and redesign.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST AI 600-1 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Agentic AI guidance addresses unsafe tool use and remaining agent capability after controls. | |
| NIST AI RMF | AI RMF frames AI risk, governance, and harm reduction relevant to residual agent capability. | |
| NIST AI 600-1 | GenAI profile emphasizes operational risk management for generative system behaviours. | |
| OWASP Non-Human Identity Top 10 | NHI guidance applies when agents use credentials or tokens that preserve post-control action paths. | |
| NIST CSF 2.0 | PR.AC | Access control outcomes are central to measuring what actions remain possible after restrictions. |
Test what the system can still complete after safeguards, and tune controls to reduce remaining harmful outcomes.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
