Agentic AI System

Source: CISA / ASD’s ACSC — Careful Adoption of Agentic AI Services, May 1 2026

Unlike Gen AI / RAG: agentic AI operates autonomously across multiple cycles · plans long-term · invokes tools · spawns sub-agents · acts without continuous human oversight

What goes wrong, and what covers most of it

The practical question is never “what is the best tool” — it is “what do I already own that does this”. Six control categories cover most of the four risks above, and most organisations can cover the first two and the last one with services already inside their cloud subscription.

The guide names five agentic AI risk categories. They are the organising frame for everything below.

Privilege

Over-broad permissions, scope creep, identity spoofing, and the confused-deputy pattern.

Least privilege per task; one cryptographically anchored identity per agent
Just-in-time credentials for privileged actions

Design & configuration

Unvetted third-party components, stale start-up authorisation, poor segmentation between agents.

Re-evaluate entitlements at every invocation, not once at start-up
Segment agent enclaves; keep tool allow lists current

Behaviour

Goal misalignment and specification gaming, deception under evaluation, prompt injection and jailbreaks.

Explicit do-not-do rules and guardrails the agent cannot override
Adversarial testing and red teaming before production

Structural

Cascading failure across coupled agents, tool squatting, rogue agents, insecure agent-to-agent traffic.

Isolation and segmentation to bound the blast radius
Mutual TLS on every inter-agent and agent-to-service call

Accountability

Opaque decision chains, sub-agent delegation, hallucination, logs that outpace human review.

Unified audit log across all inter-agent interactions
Human approval where the cost of error is high

Model layer — the controls below are the same whichever you run:Claude Anthropic API · Bedrock · VertexOpenAI OpenAI API · Azure OpenAIOpen weights Llama · Mistral, self-hosted

Control — what it does	If you run AWS	If you run Azure / Microsoft	Open source / stack-neutral
1 Agent identity and secretscovers Privilege · Accountability	IAM Roles Anywhere · Secrets Manager	Entra Workload ID · Key Vault	SPIFFE / SPIRE · HashiCorp Vault
2 Policy at the tool boundarycovers Privilege · Design & config	Cedar · Verified Permissions	Entra Conditional Access · OPA on AKS	Open Policy Agent
3 Guardrails on input and outputcovers Behaviour	Bedrock Guardrails	Azure AI Content Safety · Purview DLP	Lakera · NeMo Guardrails · Presidio
4 Sandboxed tool executioncovers Structural · Design & config	Fargate · Lambda (Firecracker)	Container Apps · Container Instances	gVisor · Firecracker · E2B
5 Evals as the release gatecovers Behaviour · Accountability	Bedrock Evaluations	Azure AI Foundry evaluations	Promptfoo · DeepEval · Ragas
6 Trace and immutable audit logcovers Accountability · Structural	CloudTrail → Security Lake	Azure Monitor → Sentinel	Langfuse · OpenTelemetry → Splunk

Start here Rows 1 and 2 — scoped agent identity and a policy check at the tool boundary — bound blast radius structurally, stopping an outcome you never authorised rather than trying to anticipate every misuse. Add row 6 next so you can prove what happened. Rows 3 to 5 can follow the second use case.

References

Primary guidance

Careful Adoption of Agentic AI Services — ASD’s ACSC, CISA, NSA, the Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK, 30 April 2026. The first coordinated Five Eyes guidance on agentic AI; source of the five risk categories and the system diagram. cisa.gov · full PDF

Industry research

Cloud Security Alliance, AI Safety Initiative — research notes on the joint guidance and the 2026 agentic identity survey: 82% of organisations have found unknown AI agents in their environment, 65% had an agent security incident in the past twelve months, and 21% have a formal agent decommissioning process. labs.cloudsecurityalliance.org

Frameworks used for mapping

OWASP Top 10 for LLM Applications — source of the OWASP identifiers on every risk row. The guidance also cites OWASP Top 10 for Agentic Applications (2026), worth reviewing alongside it.

MITRE ATLAS™ — Adversarial Threat Landscape for AI Systems; source of the AML.T identifiers, and named in the guidance as a recommended threat-modelling taxonomy.

NIST AI Risk Management Framework — source of the GOVERN / MAP / MEASURE / MANAGE subcategory references. Those mappings are our derivation, not an official crosswalk.

Also cited in the guidance

NIST SP 800-207 Zero Trust Architecture · CISA 2025 Minimum Elements for a Software Bill of Materials · CISA AI Cybersecurity Collaboration Playbook · NCSC-UK Guidelines for Secure AI System Development · MIT STAMP / STPA-Sec materials

Verification note. OWASP and MITRE ATLAS identifiers change between published versions — check both against the current release before using them in an assessment. The NIST AI RMF subcategory mappings are our derivation; NIST has not published a crosswalk at this granularity. Products named throughout are examples of a control category, not recommendations or an endorsement.