01 · Definition
What Is Agentic AI Security?
Agentic AI security protects AI agents, their data, identities, tools and actions from misuse, compromise and unsafe behaviour. Unlike a passive assistant, an agent may select steps, invoke external systems and act with delegated authority. The security boundary therefore includes the complete action path, not only the model endpoint.
Governance defines permitted purpose, responsibility and decision processes. Security provides technical protection. Runtime control observes and constrains actions while the agent operates. Strong programmes connect the three while preserving clear ownership.
02 · Threats
Security Risks Introduced by Autonomous Agents
Instruction manipulation
Hostile or untrusted content may redirect the agent or alter tool use.
Excessive agency
Broad permissions can turn a mistaken decision into a consequential action.
Identity and delegation failure
Shared credentials or lost delegation context weaken attribution and access control.
Tool and supply-chain exposure
Compromised connectors, servers, models or dependencies can extend attack paths.
Other concerns include sensitive-data disclosure, insecure output handling, memory poisoning, unbounded resource consumption and cascading agent-to-agent actions. Threat modelling should reflect the actual tools, data and consequences in the deployment.
03 · Trust
Agent Identity and Access Security
Each agent needs a distinct, verifiable identity. Access decisions should identify the agent, the user or service it represents, the requested resource and the current policy context. Short-lived credentials and workload identity are preferable to embedded, shared secrets.
Logs must preserve attribution across delegated actions. If an agent calls another agent or tool, the downstream system should receive enough context to enforce limits without treating the intermediary as an unrestricted trusted service.
Can an investigator reconstruct who initiated an action, which agent executed it, what authority was delegated and which policy allowed it?
04 · Boundaries
Least Privilege and Delegated Authority
Grant the minimum data, tools and actions required for a defined task. Scope permissions by resource, action, environment, time, transaction value and confidence where practical. Separate planning from execution for high-impact workflows and require explicit confirmation before irreversible actions.
- Default deny for tools and operations that are not required.
- Time-bound and task-bound delegated tokens.
- Step-up approval for sensitive data, payments, deletion or privilege changes.
- Independent limits that an agent cannot alter through its own instructions.
- Regular review and automatic revocation when an agent is retired.
05 · Connections
Tool and MCP Access Controls
Tool connections and MCP servers expand what an agent can observe and do. Maintain an approved catalogue, authenticate servers and clients, validate tool definitions, restrict exposed operations and treat returned content as potentially untrusted. Security review should cover transport, credentials, consent, logging and the downstream system of record.
Do not infer safety from protocol compatibility. The organisation must still authorise each connection and control the effective permissions created by combinations of tools.
Technical references
Model Context Protocol documentation · OWASP guidance for LLM and generative AI applications
06 · Enforcement
Runtime Monitoring and Policy Enforcement
Runtime controls evaluate actions in context before, during or immediately after execution. Signals may include identity, instruction source, requested tool, target data, behavioural sequence, risk classification and policy state. Enforcement can allow, redact, limit, require approval, block or terminate.
Monitoring alone is not enforcement. Buyers should ask where a decision is made, how quickly it acts, what happens when the control is unavailable, and whether policy changes can be tested safely before production.
| Control | Purpose | Evidence to test |
|---|---|---|
| Observe | Build attributable activity and detect anomalies. | Complete event trail and correlation across tools. |
| Decide | Evaluate action against identity, context and policy. | Explainable policy result with version and inputs. |
| Enforce | Prevent, constrain or interrupt unsafe behaviour. | Demonstrated block, approval or isolation outcome. |
07 · Response
Guardrails, Blocking and Escalation
Guardrails can constrain inputs, outputs and tool actions, but layered controls are necessary because no single classifier or prompt is reliable in every context. High-impact actions may need deterministic rules, transaction boundaries or human approval outside the agent's reasoning loop.
Response playbooks should define alert ownership, containment, credential revocation, evidence preservation, recovery and learning. Where safe, test blocking and escalation with realistic scenarios rather than relying on configuration screenshots.
08 · Visibility
Shadow AI and Agent Discovery
Security teams cannot protect agents they cannot see. Discovery may use cloud, identity, endpoint, network, code and SaaS signals to identify agent frameworks, embedded assistants, credentials, tool calls and unapproved services. Findings must then be enriched with business owner, purpose and approval state.
Discovery is a continuing control because agents and embedded AI features can appear through normal software updates. Integrate findings with the governance inventory so that investigation leads to ownership and treatment.
09 · Buying criteria
How to Evaluate Agentic AI Security Solutions
- Map coverage to the real agent frameworks, identity systems, tools and environments in scope.
- Demonstrate attributable discovery, including an unregistered or embedded agent.
- Test least-privilege policy and delegated identity across a multi-tool action.
- Distinguish alerting, recommendation, orchestration and direct enforcement.
- Exercise blocking, approval, fail-safe behaviour and investigation evidence.
- Review deployment model, data handling, performance impact and integration effort.
Use the agentic governance guide for organisational rules and accountability, and the platform guide for broader selection criteria.
10 · Further reading
Related Insights
Runtime AI governance: controls that act before the agent does
What policy enforcement looks like in operation.
Read insight →DiscoveryShadow AI and agent discovery: what “find everything” should mean
Test discovery scope and evidence.
Read insight →IdentityAI agent identity and permissions
Evaluate the control plane behind delegated action.
Read insight →