AGENTIC SECURITY

What is agentic security?

Agentic security is the practice of protecting AI systems that can reason, use tools, operate through identities, interact with other systems, and take actions with varying levels of autonomy.

As AI becomes more agentic, security needs to protect not only models and prompts, but the full chain of identity, permissions, tools, workflows, and actions.

Explore AI Agent Security Explore Agentic Security Threats

THE ACTION PATHReasoning → identity → tools → action

GOAL↓PLAN↓ACTFULL PATH, SECURED

THE DEFINITION

Agentic security protects the full path from reasoning to action.

Agentic security is the practice of protecting AI systems that can autonomously or semi-autonomously pursue goals, use tools, access data, call APIs, interact with other agents, and take actions.

It focuses on identities, permissions, tool access, autonomy, runtime behavior, trust boundaries, and multi-step workflows.

AI agent discovery
Agent identity and permissions
Least privilege
Tool and MCP security
Runtime action control
Human approval
Prompt injection defense
Multi-agent trust
Red teaming
Monitoring and auditability

THE TERM

What does agentic mean in AI?

Agentic AI refers to AI systems that can pursue a goal by deciding what steps to take, using tools or external systems, and adapting their behavior based on results.

PlanRetrieve informationChoose toolsCall APIsInteract with softwarePerform actionsDelegate tasksCoordinate with other agents

Not all generative AI is agentic. The distinction is whether the system can decide and carry out a path toward a goal.

CATEGORY BOUNDARIES

Agentic security vs. AI security

Agentic security is part of AI security, focused on systems that can act.

AI SECURITYBroad parent category

Protects models, AI applications, data, infrastructure, AI agents, and the AI supply chain.

What is AI Security?

AGENTIC SECURITYSecurity for systems that can act

Focuses on tools, identities, autonomy, multi-step workflows, trust boundaries, and actions.

THE ACTION SYSTEM

Agentic security vs. AI agent security

AI agent security protects an individual agent. Agentic security can be broader: it protects the wider system of agents, tools, permissions, and workflows around it.

What is AI Agent Security?

AI AGENT SECURITYProtect the individual agent

Identity, permissions, tools, data, and actions.

AGENTIC SECURITYProtect the wider system

Orchestration, delegated authority, shared tools, agent-to-agent interaction, and emergent behavior.

WHY IT MATTERS

Why do agentic systems create new security risks?

Agentic systems may dynamically decide which step to perform next, which tool to invoke, which data to retrieve, whether to call another agent, whether to retry, or whether to modify a system.

Was this action appropriate for the task?Was this tool necessary?Should this identity have this access?Should the agent act without approval?Is this multi-step sequence safe?Can untrusted content influence the workflow?

THE AGENTIC ATTACK SURFACE

What does the agentic attack surface include?

The security boundary follows the path an agent can take through a system, from input to data and action.

01INPUTSPrompts · Documents · Web · Email · RAG

02AGENTReasoning · Planning · Memory · Autonomy

03IDENTITYCredentials · Roles · Delegation

04TOOLSAPIs · Functions · Code · Browser · SaaS

05MCPServers · Tools · Resources

06OTHER AGENTSDelegation · Coordination · Shared context

07ENTERPRISE SYSTEMSCloud · CRM · Databases · Messaging

08DATA + ACTIONSRead · Write · Send · Transfer · Execute · Delete

RISK TAXONOMY

What are the main agentic security risks?

PROMPT INJECTIONManipulated input changes agent behavior.INDIRECT PROMPT INJECTIONExternal content influences the workflow.EXCESSIVE AGENCYAn agent has too much autonomy.OVERPRIVILEGED AGENTSAn agent has too much access.TOOL MISUSELegitimate capabilities are used unsafely.DATA EXFILTRATIONSensitive information leaves approved boundaries.MCP RISKMCP expands tools, permissions, and trust relationships.

MULTI-AGENT RISKOne agent passes data, instructions, or authority to another.

MEMORY POISONINGPersistent context influences future actions.

CHAINED ACTION RISKSeveral acceptable actions produce an unsafe result.

IDENTITY + ACCESS

Agentic systems need identity boundaries

Agents may operate through service accounts, workload identities, API keys, OAuth tokens, cloud roles, user delegation, and downstream MCP credentials.

Security teams need to understand which identity acts, what permissions it has, what access is inherited, who owns it, and whether it is appropriate for the task.

Autonomy without identity boundaries creates unnecessary risk.

Explore Agent Identity & Permissions

Service accountWorkload identityAPI keyOAuth tokenCloud roleUser delegationMCP credentialDownstream access

LEAST PRIVILEGE

Agentic systems should follow least privilege

NEEDEDRead access

NOT AUTOMATICALLY NEEDEDWrite · Export · Delete · Admin · External send

Least privilege should apply to systems, data, tools, actions, environments, and duration.

Explore Overprivileged Agents

AUTONOMY + ACCESS

Security should control how much agents can decide on their own

Permission answers “What can the agent do?” Autonomy answers “What can the agent decide and execute without review?”

Explore Excessive Agency

Permission and autonomy risk matrix
	Low autonomy	High autonomy
Low access	Lower risk	Moderate risk
High access	Elevated risk	Highest risk

TOOLS

Tools turn agent reasoning into action

Tools can let agents query systems, modify records, execute code, send messages, upload files, trigger workflows, or alter infrastructure.

Security should consider which tools exist, which agent can use them, what credentials they use, which parameters are requested, and whether the action fits the task.

Explore Tool Misuse

REASONING↓TOOL CALL↓ENTERPRISE ACTION

MCP SECURITY

MCP creates new agentic trust relationships

MCP can expand tool availability, data access, downstream credentials, third-party dependencies, and external content paths.

Review which servers exist, who owns them, which tools they expose, what systems they reach, whether output is trusted, and which calls require approval.

What is MCP Security? Explore MCP Security

AGENT↓MCP SERVER↓TOOLS + RESOURCES↓DOWNSTREAM SYSTEM

MULTI-AGENT SECURITY

What changes when agents interact with other agents?

Agent-to-agent systems may introduce delegated tasks, transferred context, shared credentials, changing trust boundaries, unclear attribution, compounded autonomy, and cascading errors.

AGENT Adelegates task ↓AGENT Buses tool ↓SYSTEM

Security questions:

What authority was delegated?
What context was shared?
Which identity executed the action?
Can Agent B exceed Agent A’s intended scope?
Is the final action attributable?

SEQUENCE RISK

Agentic security must evaluate the workflow, not just one action

1Read customer records

2Generate report

3Upload file

4Send link externally

Agentic risk often emerges from the sequence.

Each step may be allowed in isolation. Together, they can create a data-exfiltration path.

RUNTIME SECURITY

Agentic systems need action-time security decisions

A static role may allow an action. Runtime policy can consider the agent, task, identity, permissions, tool, resource, data, destination, environment, and prior actions.

ALLOWREVIEWBLOCK

Explore Runtime Security

SHOULD THIS AGENT ACT NOW?Context changes the decision.

ALLOWREVIEWBLOCK

HUMAN CONTROL

Autonomy does not need to mean zero human control

Different actions can receive different autonomy levels. Human review can preserve productivity without granting unlimited autonomy.

READ PUBLIC DATAAUTONOMOUS

UPDATE INTERNAL DRAFTAUTONOMOUS

EXTERNAL COMMUNICATIONCONTEXT-DEPENDENT

FINANCIAL TRANSACTIONAPPROVAL

DESTRUCTIVE PRODUCTION ACTIONSTRONG AUTHORIZATION

PROMPT INJECTION

Prompt injection becomes more serious when AI can act

Agentic security should assume that content-layer defenses may sometimes fail. Controls should also reduce the impact of manipulation.

Prompt Injection Indirect Prompt Injection

UNTRUSTED CONTENT↓AGENT MANIPULATED↓TOOL CALLED↓SENSITIVE ACTION

DATA MOVEMENT

Agentic systems create new data movement paths

Agents may retrieve, transform, pass, send, upload, or write data across systems.

SOURCEWhat data was accessed↓AGENTWhich agent handled it↓ACTIONWhat happened to it↓DESTINATIONWhere it went

Explore Data Exfiltration

ADVERSARIAL TESTING

Red team the full workflow

Agentic testing should go beyond model output and test the path through inputs, permissions, tools, approvals, agents, data, and runtime control.

Explore AI Red Teaming

Manipulated inputsUnsafe permissionsTool misuseApproval bypassMCP manipulationMulti-agent delegationChained actionsData movementRuntime-control failure

SECURITY LIFECYCLE

How to secure agentic systems

01DISCOVERFind agents, tools, and MCP connections.

02MAPUnderstand identities, permissions, data, and trust boundaries.

03LIMITReduce unnecessary access and autonomy.

04TESTRed team the workflow.

05CONTROLApply runtime policy and approvals.

06MONITORObserve actions and interactions.

07INVESTIGATETrace behavior across agents and systems.

08REVIEWReassess as workflows change.

PRACTICAL GUIDANCE

Agentic security best practices

01INVENTORY AGENTS

02ASSIGN OWNERSHIP

03MAP IDENTITIES

04APPLY LEAST PRIVILEGE

05LIMIT TOOL CAPABILITIES

06SECURE MCP CONNECTIONS

07CONTROL AUTONOMY

08TREAT EXTERNAL CONTENT AS UNTRUSTED

09EVALUATE MULTI-STEP BEHAVIOR

10SECURE AGENT-TO-AGENT COMMUNICATION

11RED TEAM WORKFLOWS

12LOG ACTIONS

13REVIEW CONTINUOUSLY

REFERENCE ARCHITECTURE

A practical agentic security architecture

Security layers should follow the system from users and orchestration through agents, tools, identities, enterprise systems, data, and actions.

USERS / SYSTEMS↓

AGENT ORCHESTRATOR↓

AGENTS↓

MODELS↓

TOOLS / MCP / OTHER AGENTS↓

IDENTITIES↓

ENTERPRISE SYSTEMS↓

DATA / ACTIONS

DISCOVERYIDENTITYPERMISSIONSTOOL POLICYRUNTIME CONTROLAPPROVALRED TEAMINGMONITORINGAUDIT

GOVERNANCE

Agentic security and governance overlap, but they are not the same

GOVERNANCEDefines policy, ownership, acceptable use, accountability, and risk requirements.

SECURITYImplements technical controls around identities, permissions, tools, data, actions, and runtime behavior.

Governance defines the rules. Security helps enforce them.

OPERATING MODEL

Who is responsible for agentic security?

Ownership varies, but agentic systems often cross several security domains simultaneously.

CISOSECURITY ARCHITECTUREAPPSECIDENTITY SECURITYCLOUD SECURITYDATA SECURITYAI PLATFORMENGINEERINGGRCRISK

FOR SECURITY TEAMS

Questions to ask about an agentic system

Which agents exist?
Who owns each agent?
What goal is each pursuing?
Which identity does each use?
What permissions are available?
What tools can they invoke?
Which MCP servers are connected?
Can agents communicate with other agents?
What data can they access?
Which actions can happen autonomously?
Which actions require approval?
Can external content influence behavior?
Can actions chain into an unsafe outcome?
Is every action attributable?
Has the workflow been red teamed?
What happens when controls fail?

AUTHORITATIVE GUIDANCE

Agentic security frameworks and guidance

These resources provide shared language for threat modeling, testing, and risk management. They do not imply endorsement of Eyrane.

OWASPAgentic AI threats, mitigations, and secure application guidance.MITRE ATLASAdversarial tactics and techniques for AI systems.NISTAI risk-management and cybersecurity guidance.

EYRANE’S POINT OF VIEW

Secure the system around the agent

Agentic security is broader than protecting a single model.

The security boundary includes the agent, its identity, permissions, tools, MCP connections, other agents, enterprise systems, and the actions that result.

Eyrane is focused on securing that path.

DISCOVER→UNDERSTAND→CONTROL

Explore AI Agent Security