Executive perspective
The central challenge in agentic AI is not simply that AI introduces new cyber vulnerabilities. It is that AI increases the number of decisions, interactions, execution paths and trust relationships an organisation must govern.
Traditional cybersecurity protects defined assets, identities, applications, networks and data flows. Agentic AI adds systems that can interpret objectives, plan actions, invoke tools, interact with other agents and adapt their behaviour to changing context.
The strategic shift: move beyond protecting components alone. Constrain what agents can do, what they can combine, whose authority they use and how their actions affect the business.Established emphasis
Protect assets
Identity, infrastructure, applications, data, known workflows and conventional access boundaries.
Additional emphasisConstrain agency
Available actions, delegation, execution sequences, context, transaction effects and recovery.
The agentic emphasis extends established cybersecurity; it does not replace it.
1. Why combinatorial complexity matters
Imagine an agent that can read enterprise documents, query a database, call APIs, delegate work and initiate a business workflow. Each capability may be legitimate in isolation. Risk can emerge from how they are combined, in what order, with which data and under whose authority.
A simple permutation example
Suppose an agent has six available tools and selects three distinct tools in sequence. The number of ordered sequences is:
6 × 5 × 4 = 120 possible sequences
Illustrative mathematics only. Real agentic systems may permit repeated actions, conditional branches, state changes, concurrent agents and different permission sets, making the actual state space substantially more complex.
Dimensions of the problem space
Actions
What can the agent do?
Sequences
Which actions can follow others?
State
How do data and permissions change?
Authority
Who or what can authorise an operation?
Context
Which instructions and retrieved inputs influence it?
Concurrency & time
What do retries, delays and parallel agents change?
Executive implication: the number of possible behaviours can be much larger than the number of components. Testing each component separately is not enough to assure the whole system.
2. The problem is larger than the model
Treat an agentic AI solution as a system of interacting components, not as a model with a prompt.
| Layer | What it involves |
|---|---|
| Objective & instructions | Business goal · policies · user request |
| Agent reasoning & planning | Model · context · memory · planning |
| Documents · retrieval · databases | Information |
| Tools · APIs · workflows · agents | Execution |
| Enterprise impact | Disclosure · decisions · transactions · system changes |
| Cross-cutting control plane | Identity · policy · audit · evaluation · approval · emergency stop |
Conceptual diagram. Controls must also exist at the relevant boundaries; a central policy layer cannot compensate for an over-privileged credential or an unprotected downstream service.
| Dimension | Executive question | Typical failure |
|---|---|---|
| Capability | What can the agent do? | Excessive permissions |
| Composition | What can it combine? | Permitted actions combine into an unauthorised outcome |
| Context | What can influence it? | Malicious instructions hidden in retrieved content |
| Propagation | What happens next? | One agent's error triggers downstream actions or other agents |
Relevant threat areas include prompt injection, excessive agency, identity abuse, insecure inter-agent communication and cascading failures. See the OWASP GenAI Security Project.
3. Reduce the problem space
The strongest strategy is not to make a model reason about every possible danger. Design the system so dangerous paths are unavailable, blocked by deterministic controls or require explicit approval.
1. Reduce capabilities
Give each agent only the tools, data and actions needed for its task. Prefer narrow, purpose-built interfaces to general-purpose access.
2. Enforce rules outside the model
Use conventional code, identity systems and policy engines to authorise actions. Model-generated assurances are not security controls.
3. Reduce branching
Use predefined workflows for consequential processes. Limit recursive delegation, agent-to-agent communication and unrestricted retries.
4. Define decision boundaries
Require approval for high-impact actions such as external disclosure, financial commitments, privilege changes or consequential record updates.
5. Observe and constrain execution
Record tool calls and outcomes, set budgets and limits, test adverse scenarios, and ensure operators can halt or revoke access.
6. Design for recovery
Use reversible operations where possible, idempotency controls, transaction boundaries, rollback procedures and tested emergency stops.
Illustrative narrowing of possible action sequences
Hypothetical counts to show the principle, not measured industry data or a forecast of risk reduction.
Fewer paths do not automatically mean lower risk. One high-impact path can be enough to cause a serious incident. Optimise for risk-weighted reduction: remove or control combinations involving sensitive data, elevated authority, external effects and irreversible changes.
4. Essential security controls
| Control | What it achieves | What to require |
|---|---|---|
| Agent identity | Attribution and accountability | Dedicated identities, ownership and lifecycle management |
| Least privilege | Limits compromise impact | Task-specific, short-lived and narrowly scoped access |
| Tool allowlisting | Limits executable options | Approved tools, operations and destinations |
| Deterministic authorisation | Prevents self-granted authority | Independent policy checks at execution time |
| Data boundaries | Reduces disclosure and access risk | Classification, scoped retrieval and egress controls |
| Workflow constraints | Limits unsafe sequences | Defined state transitions, quotas, timeouts and retry limits |
| Human approval | Oversight at consequential boundaries | Approval bound to the exact action and parameters |
| Audit and monitoring | Detection and investigation | Correlated traces across identities, agents, tools and transactions |
| Adversarial testing | Finds failures under attack | Repeatable evaluations before and after changes |
| Containment and recovery | Limits operational damage | Credential revocation, tool disablement, workflow stop and recovery |
Important nuance: human approval must be meaningful. The approver should see the destination, data, amount, scope and consequences. Guardrails and prompt-injection filters are useful defence-in-depth, not guarantees; high-impact operations still need conventional authorisation and transaction controls.
5. Frameworks, platforms and products
Do not purchase a second security stack by default. Inventory existing capabilities, identify gaps and add products selectively. These options are representative starting points, not a universal ranking; validate current features, licensing, deployment constraints and integration fit.
Frameworks and practices
GovernanceNIST AI RMF & GenAI Profile
Risk ownership, lifecycle governance, measurement and treatment. Connect AI risk to enterprise risk management.
AI Risk Management Framework · GenAI Profile
Threat modellingOWASP Top 10 for Agentic Applications
Map agent-specific threats, including goal hijacking, tool misuse, identity abuse, memory poisoning and cascading failures, to engineering requirements.
Adversarial testingMITRE ATLAS
Use adversarial techniques and case studies to create attack scenarios, challenge assumptions and improve incident readiness.
Management systemsISO/IEC 42001 + ISO/IEC 27001
Align AI management-system governance with the information security management system. Integrate evidence and accountability.
Enterprise platforms and implementation options
Microsoft Foundry
Evaluate for Azure-centric environments: agent development, evaluation and tracing, and integration with Entra, Defender and Purview.
Amazon Bedrock
Evaluate for managed model access and guardrails within AWS. Pair model-layer safeguards with application authorisation and workload controls.
Google Vertex AI
Evaluate for managed AI development, deployment, safety features and integration with Google Cloud identity and security controls.
Open Policy Agent (OPA)
Policy engine to separate authorisation decisions from model reasoning. Integrate at API gateways, tool brokers or application boundaries.
Langfuse
Consider for tracing, evaluation and operational visibility. Validate framework coverage, hosting, access controls and sensitive-data handling.
Existing security stack
Start with identity, secrets management, endpoint and cloud security, SIEM, data protection, API management and incident response already in place.
Extend before duplicating.
Selection principle: for organisations invested in a major cloud, first assess existing identity, logging, data protection and security operations. A separate agent-security product may be justified for multi-cloud estates, SaaS connectors, custom frameworks or gaps in agent-specific enforcement.
6. Reference architecture
This is a proposed enterprise pattern, not a requirement to buy every component.
| Layer | What it involves |
|---|---|
| Enterprise governance | Risk appetite · approved use cases · accountable owners |
| Agent runtime & model gateway | Approved models · scoped context · runtime guardrails |
| Policy enforcement & tool broker | Identity · permissions · action validation · approvals · budgets |
| Other agents and workflows | |
| Continuous assurance across all layers | Logs and traces · evaluations · security analytics · response · revocation |
The model proposes
The model may recommend an action, but independent controls determine whether it can execute.
Services enforce authority
A compromised agent must not bypass the permissions of the underlying system.
Actions are attributable
Investigators can reconstruct who initiated an action, under what authority, with which inputs and with what result.
7. A practical 90-day onboarding plan
A proposed planning horizon, not a guarantee that every production deployment can be secured in 90 days. Adjust for criticality, integration complexity and regulatory obligations.
Days 1–30 · Discover
Establish the baseline
- Inventory agents, models, tools, connectors, identities and data access.
- Select one bounded business workflow.
- Map possible actions and high-impact failure scenarios.
- Identify existing platform controls and material gaps.
- Assign business, technical and security owners.
Days 31–60 · Constrain
Implement the minimum control set
- Enforce dedicated identities and least privilege.
- Restrict tools, operations, destinations and data scopes.
- Put deterministic authorisation at execution boundaries.
- Add approval gates for defined high-impact actions.
- Instrument tracing, audit logging, limits and emergency revocation.
Days 61–90 · Validate
Demonstrate control effectiveness
- Test prompt injection, data leakage, privilege misuse and unsafe tool sequences.
- Verify prohibited actions are blocked even when requested by the model.
- Test shutdown, credential revocation and recovery.
- Measure task quality, control effectiveness, latency and operating cost.
- Present evidence and a go/no-go recommendation to the accountable executive.
8. The executive dashboard
A dashboard reporting agent adoption, task success and cost per interaction is incomplete. Leaders need evidence that autonomy is bounded and failures are contained.
Control coverage
Share of production agents with an accountable owner, registered identity, approved tools, scoped permissions and complete audit coverage.
Prohibited-action resistance
Share of defined adversarial test cases in which prohibited actions are blocked. Track severity-weighted failures, not just an aggregate score.
Observability & accountability
Share of consequential actions with correlated records of identity, authorisation, inputs, decision and outcome.
Containment & recovery
Time to detect, revoke authority, stop affected workflows and restore a trusted operating state.
Risk-adjusted business value
Productivity and quality gains weighed against residual risk, oversight burden, operating cost and incident exposure.
Change resilience
Evidence that model, prompt, tool, policy and connector changes trigger appropriate regression tests and re-approval.
Set thresholds according to business impact. An agent drafting internal summaries has a different risk profile from an agent changing production access controls or committing the organisation to a financial transaction.
9. Decisions required from the executive team
- Define the autonomy boundary. Which actions may be performed independently, which require approval and which are prohibited?
- Mandate an approved control architecture. Set minimum identity, authorisation, logging, testing and containment requirements for production agents.
- Fund shared controls, not just individual pilots. Invest in reusable identity integration, policy enforcement, agent inventory, evaluation and monitoring.
- Assign accountability. Business owners remain accountable for outcomes and risk acceptance; security and engineering own the effectiveness of their respective controls.
- Make evidence a condition of scale. Require demonstrated control effectiveness and tested recovery before expanding privileges, data access or autonomy.
Final perspective
The competitive advantage will not necessarily belong to the organisation with the most capable models or the greatest number of agents. It may belong to the organisation that can deploy useful autonomy safely while retaining control over what those systems can do.
How much useful intelligence and autonomy can we enable within a deliberately bounded, observable and enforceable space of actions?
That is the bridge between AI innovation and enterprise-grade cybersecurity.
Sources & further reading
- OWASP GenAI Security Project, Agentic Security Initiative: threat models, mitigations and evolving implementation resources.
- NIST AI Risk Management Framework: structured AI risk governance and lifecycle management.
- MITRE ATLAS: adversarial techniques and case studies for AI threat modelling.
- ISO/IEC 42001: AI management system standard.
- Microsoft security guidance for agentic systems: implementation patterns for identity, runtime controls and monitoring.
- Open Policy Agent: policy-as-code tooling.
- Langfuse: LLM observability and evaluation platform.
Product capabilities and standards evolve. Verify current documentation, licensing, deployment options and applicable regulatory requirements before procurement or implementation. This briefing is strategic guidance, not a substitute for a workload-specific threat model or professional legal and regulatory advice.
Interactive companion
The Maze Permutation Simulation puts the central argument into a simulated run. It drops an agent through a maze of nodes and counts the paths that remain possible as capabilities, workflow constraints and approval gates are added, which is the same narrowing described in section 3.