Voice of the CISO · AI Threat Landscape · Reference architecture view

The Agentic AI Risk and Control Landscape

Organizations are adopting AI faster than they can see it, govern it, or secure it.

How agentic AI operates across identities, permissions, applications, connectors, data, models and business workflows; how risk propagates through those connections; which people, process and technical controls reduce it; and what evidence proves the controls are operating.

An agent is not a feature. It is an identity operating with delegated authority, data access, and the ability to take actions.

The question is no longer who has access. It is which agent is acting, and on whose behalf.

AI is not a new category of threat. It is a new rate of change and a new surface.

Executive framing: what actually changed

Three shifts happened at once. Both halves of the problem fail through the same conditions, so one governance model and one owner should answer for both.

Hours, not weeks

Adversary speed

Campaign work that took weeks now takes hours, in fluent language.

Identities to govern

Internal surface

Copilots and agents now hold identities, permissions and data.

Policy lags adoption

Governance lag

Adoption is running ahead of inventory, policy and monitoring.

EXTAI used against the organization

AI-assisted reconnaissance and target mapping at machine speed
Fluent, highly targeted phishing with no language tells
Deepfake voice and video impersonation of named leaders
Faster malware and exploit tooling iteration
Prompt injection against the AI you deploy

same failure conditions

Both sides fail the same way

Unknown identities
Unknown access
Unknown activity
Unclear ownership recommended
Insufficient monitoring recommended

One model, one owner: the same program should answer for both columns.

same failure conditions

INTAI deployed by the organization

Agents acting with delegated authority
Machine identities at scale
Excessive and standing permissions
Shadow AI and unmanaged applications
AI-connected SaaS integrations
Vulnerable AI workloads and models

Agentic AI ecosystem: layered trust and authority map

Authority delegates downward through the layers; telemetry, approval and revocation return upward and across to assurance. Every arrow is a place a control applies, or is missing.

People and accountability layer

Human users

Business owners

Developers and AI builders

Identity and access teams

Data owners

Risk, legal, compliance, privacy and procurement

Delegation Approval and review

AI layer

AI applications and copilots

AI agents

Machine and workload identities (non-human identities)

Models and AI workloads

Authentication and authorization Logging and telemetry

Access, tools and application layer

Enterprise applications

SaaS platforms

APIs, plugins, tools and connectors

External services and consumer AI tools

Tool invocation, API calls and cross-system actions Revocation and containment

Data layer

Data repositories

Sensitive and regulated data

Connector key: what moves between layers

Authentication Delegation Authorization Data retrieval Data creation or modification Tool invocation API calls Cross-system actions Logging and telemetry Approval and review Revocation and containment

End-to-end agentic workflow

Ten stages, each with the actor, the permission exercised, the data crossing it, the decision taken, the risk, the preventive and detective control, the accountable owner, and the evidence that should exist.

User request

Actor or asset: Human user; business owner accountable for the use case
Permission exercised: The person's own entitlements, which the agent will inherit
Data in and out: In: prompt, attached or pasted content. Out: task intent
Decision or action: Person asks an AI application to do work on their behalf
Risk EXT: Fluent phishing or social engineering starts the task; company data pasted into an unapproved consumer tool
Preventive control: Workforce education for AI-enabled phishing and impersonation; approved-tool guidance (P)
Detective control: Data loss prevention at the AI interaction layer; discovery of unapproved AI use (D)
Accountable owner: Business owner with security awareness function
Evidence and telemetry: Prompt and session record tied to the initiating person

AI application

Actor or asset: Copilot, chat interface or custom AI application
Permission exercised: Application registration, consented scopes and connector grants
Data in and out: In: user prompt plus application context. Out: request to the agent runtime
Decision or action: Application resolves intent and selects an agent or workflow
Risk INT: Shadow AI outside inventory; SaaS connectors quietly widening data access
Preventive control: Formal intake and risk classification; approval before connecting AI to systems of record (P)
Detective control: Living inventory of AI applications, agents, copilots, models, connectors and workloads (D)
Accountable owner: Application owner with identity and access team
Evidence and telemetry: Inventory entry: purpose, data scope, approver, review date

Agent identity

Actor or asset: AI agent operating as a machine or workload identity
Permission exercised: Credentials, secrets and delegated user authority
Data in and out: In: delegated token. Out: authenticated agent session
Decision or action: Agent authenticates and assumes delegated authority
Risk IAM: Unmanaged machine identities; standing authority an attacker can borrow
Preventive control: Strong agent and workload identity; secrets management and credential rotation (P)
Detective control: Machine identity lifecycle monitoring on the same cadence as employees (D)
Accountable owner: Identity and access team with named technical owner
Evidence and telemetry: Identity record: owner, scope, review cadence, revocation path, expiry

Permissions evaluation

Actor or asset: Authorization and policy services
Permission exercised: Effective permissions: least privilege, just-in-time, time-bound
Data in and out: In: requested resource and scope. Out: allow, deny or step-up
Decision or action: Policy decides whether this agent may act on this resource now
Risk IAM: Excessive and standing permissions; permissions granted for a pilot and never revoked
Preventive control: Least privilege; just-in-time access; conditional access and risk-based authentication (P)
Detective control: Permission review and recertification; standing-privilege reporting (D)
Accountable owner: Identity and access team with data owner approval
Evidence and telemetry: Authorization decision log, entitlement history, recertification record

Model reasoning

Actor or asset: Model or AI workload and its endpoints
Permission exercised: Model and endpoint access; system prompt and tool manifest
Data in and out: In: prompt, system instructions, retrieved context. Out: plan of action
Decision or action: Model plans the steps needed to satisfy the request
Risk APP: Prompt injection, including indirect injection carried in retrieved content
Preventive control: Prompt injection defenses; input and output filtering; model and endpoint hardening (P)
Detective control: AI-specific threat modeling and testing; injection and misuse detections (D)
Accountable owner: AI engineering with security architecture
Evidence and telemetry: Model, prompt and system-instruction version history with test results

Data retrieval

Actor or asset: Grounding and retrieval services over data repositories
Permission exercised: Read rights on repositories, sites, mailboxes and records
Data in and out: In: query. Out: retrieved content, potentially sensitive or regulated
Decision or action: Agent reads the content it needs to reason and answer
Risk DAT: Oversharing surfaced instantly by AI search; abnormal or high-volume data retrieval
Preventive control: Data classification and labeling; retrieval and grounding controls; data loss prevention (P)
Detective control: Detection of abnormal data pulls; agent and data telemetry (D)
Accountable owner: Data owner with security operations
Evidence and telemetry: Query and access logs naming the data accessed and the identity that read it

Tool or API invocation

Actor or asset: Connectors, plugins, APIs and downstream applications
Permission exercised: Tool-use rights and connector scopes in each target system
Data in and out: In: parameters and payload. Out: system response
Decision or action: Agent calls a tool or API, potentially crossing systems
Risk APP: Agent misuse or compromise; connectors widening reach across systems of record
Preventive control: Connector and API allowlisting; tool-use restrictions; defined agent scope (P)
Detective control: Tool invocation telemetry with behavioral analytics (D)
Accountable owner: Application owner with the identity and access team
Evidence and telemetry: Tool call record: agent, tool, parameters, target system, result

Business action

Actor or asset: System of record and the business process it serves
Permission exercised: Write, approve, transact or configure rights
Data in and out: In: instruction. Out: created or modified business data
Decision or action: An action with business consequence is taken
Risk OPS: Actions taken without meaningful human oversight; data crossing organizational or regulatory boundaries
Preventive control: Human approval for sensitive or irreversible actions; segregation of duties (P)
Detective control: Correlated investigation across human and machine actors (D)
Accountable owner: Named business owner accountable for agent actions
Evidence and telemetry: Approval record linking the initiating person to the executed action

Output

Actor or asset: Human recipient, downstream system or external party
Permission exercised: Sharing and export rights on the resulting content
Data in and out: In: results. Out: answer, document, message or record, possibly leaving the tenant
Decision or action: Result is returned, shared, stored or sent onward
Risk REG: Sensitive data exposure; AI use with no record of purpose, data or decision logic
Preventive control: Output filtering; labeling inheritance and egress controls (P)
Detective control: Data loss prevention alerting at the AI interaction layer (D)
Accountable owner: Data owner with privacy and legal
Evidence and telemetry: Output record with sensitivity label, recipients and retention

Logging and monitoring

Actor or asset: Security operations and monitoring platforms
Permission exercised: Read access to agent, identity, application and data telemetry
Data in and out: In: signal from every prior stage. Out: alerts, cases, containment
Decision or action: Behavior is detected, investigated and, where needed, contained
Risk OPS: Inadequate audit records; missing ownership or revocation paths
Preventive control: Logging and evidence-retention requirements agreed before go-live (P)
Detective control: Behavioral analytics; rapid revocation of delegated authority; agent isolation or disabling (D)
Accountable owner: Security operations with incident ownership across identity, data, legal and privacy
Evidence and telemetry: Audit record of initiating person, acting agent, permission used, data accessed, tool invoked, action taken and outcome

Stage 05 continues from stage 04 on the row above. Stage 10 returns signal to every earlier stage.

Decision points that must fail closed

Is human approval required?

Sensitive or irreversible actions stop for a named approver.

Applies at stage 08

Is the requested data permitted?

Label, classification and data owner approval decide, not convenience.

Applies at stage 06

May the agent invoke this tool?

Allowlisted connectors and tools only, within the approved scope.

Applies at stage 07

Does the action exceed approved scope?

Out-of-scope requests fail closed and raise a case.

Applies at stage 08

Should anomalous behavior trigger containment?

Revoke delegated authority and isolate the agent, not only the user account.

Applies at stage 10

Risk pathways and the controls that reduce them

Every pathway carries a risk category and at least one connected mitigating control.

EXTExternal adversary risk INTInternal deployment risk IAMIdentity and permission risk DATData risk APPApplication and model risk OPSOperational risk REGCompliance and regulatory risk

EXT

AI-assisted reconnaissance

Target mapping and open-source intelligence at machine speed.

mitigated by

Workforce education
Attack surface reduction
Behavioral analytics

EXT

Fluent, highly targeted phishing

Lures arrive with no spelling or grammar tells.

mitigated by

Workforce education
Verification procedures
Input filtering and mail controls

EXT

Deepfake voice or video impersonation

Impersonation of a named leader is cheap enough to use on a single approval.

mitigated by

Help desk and finance verification that does not rely on voice, video or writing style
Segregation of duties
Conditional access and step-up authentication

EXT

Faster malware and exploit development

Tooling and payloads iterate faster than before.

mitigated by

Vulnerability management
Workload posture management
Detection engineering

APP

Prompt injection

Instructions smuggled into a trusted interface redirect the agent.

mitigated by

Prompt injection defenses
Input and output filtering
AI-specific threat modeling and testing

APP

Indirect prompt injection through retrieved content

The payload arrives inside the content the agent was told to trust.

mitigated by

Retrieval and grounding controls
Content provenance checks
Tool-use restrictions

IAM

Agent misuse or compromise

An adversary borrows an agent that already holds standing authority.

mitigated by

Rapid revocation of delegated authority
Agent isolation or disabling
Incident response procedures for agent containment

IAM

Excessive and standing permissions

Access granted for a pilot is never revoked.

mitigated by

Least privilege
Just-in-time and time-bound access
Permission review and recertification

IAM

Unmanaged machine identities

Non-human identities outnumber people and lack a lifecycle.

mitigated by

Strong agent and workload identity
Secrets management and credential rotation
Expiration and revocation requirements

INT

Shadow AI

Unmanaged tools and accounts never reach the asset inventory or the SIEM.

mitigated by

Living AI inventory
Continuous assessment rather than periodic surveys
Discovery of unapproved AI use

INT

Unapproved consumer AI use

People solving real problems with tools that were never reviewed.

mitigated by

Approved-tool guidance and enablement
Formal intake and risk classification
Data loss prevention at the AI interaction layer

DAT

Sensitive data exposure

Company data leaves the tenant or reaches the wrong audience.

mitigated by

Data classification and labeling
Data loss prevention
Output filtering

DAT

Oversharing surfaced through AI search

Permissions that were wrong but invisible become instantly discoverable.

mitigated by

Permission remediation at the repository
Retrieval and grounding controls
Detection of abnormal data pulls

INT

SaaS connectors widening data access

Each integration quietly extends reach into systems of record.

mitigated by

Connector and API allowlisting
Approval before connecting AI to systems of record
Third-party and SaaS AI risk review

APP

Vulnerable AI workloads, models and endpoints

AI workloads sit outside the hardening standard applied elsewhere.

mitigated by

Workload posture management
Vulnerability management
Model and endpoint hardening

OPS

Missing ownership or revocation paths

No one can say who approved an agent or who can switch it off.

mitigated by

Named business owner for every agent
Named technical owner
Expiration and revocation requirements

REG

Data crossing organizational or regulatory boundaries

Movement that human judgment used to prevent now happens by default.

mitigated by

Data owner approval
Use-case and data-purpose documentation
Security and privacy review

REG

Inadequate audit records

No record of purpose, data or decision logic for examiners.

mitigated by

Logging and evidence-retention requirements
Audit logging of person, agent, permission, data, tool, action and outcome
Change management for prompts, models, tools, connectors and data sources

OPS

Abnormal or high-volume data retrieval

Agent behavior that would look alarming for an employee.

mitigated by

Agent, identity, application and data telemetry
Behavioral analytics
Correlated investigation across human and machine actors

OPS

Actions taken without meaningful human oversight

Business consequence with no person in the loop.

mitigated by

Human approval for sensitive or irreversible actions
Clear accountability for agent actions
Periodic exercises covering injection, leakage, impersonation and compromised agents

People, process and technical controls

One consistent three-part model. Items marked recommended extend the source deck as standard practice rather than restating it.

People controls

Accountability expressed as roles and operating responsibilities.

Named business owner for every agent
Named technical owner
Data owner approval recommended
Security and privacy review recommended
Clear accountability for agent actions
Defined segregation of duties recommended
Workforce education for AI-enabled phishing and impersonation
Help desk and finance verification that does not depend solely on voice, video, writing style or caller recognition
Incident ownership across security, identity, data, legal, privacy and business teams recommended

Process controls

Operating routines that produce evidence, not statements of intent.

Living inventory of AI applications, agents, copilots, models, connectors and workloads
Formal intake and risk classification recommended
Use-case and data-purpose documentation recommended
Approval before connecting AI to systems of record
Permission review and recertification
Defined agent scope and operating boundaries
Expiration and revocation requirements
Change management for prompts, models, tools, connectors and data sources recommended
Human approval for sensitive or irreversible actions recommended
Logging and evidence-retention requirements recommended
Continuous assessment rather than periodic surveys
AI-specific threat modeling and testing recommended
Incident response procedures for agent containment
Periodic exercises covering prompt injection, data leakage, impersonation and compromised agents recommended
Third-party and SaaS AI risk review recommended

Technical controls

Identity, data, application and monitoring controls applied to a new asset class.

Strong agent and workload identity
Least privilege
Just-in-time and time-bound access recommended
Conditional access and risk-based authentication recommended
Secrets management recommended
Credential rotation recommended
Data classification and labeling
Data loss prevention at the AI interaction layer
Connector and API allowlisting recommended
Tool-use restrictions recommended
Input and output filtering recommended
Prompt injection defenses
Retrieval and grounding controls recommended
Workload posture management
Vulnerability management
Model and endpoint hardening
Agent, identity, application and data telemetry
Behavioral analytics recommended
Detection of abnormal data pulls
Correlated investigation across human and machine actors
Rapid revocation of delegated authority
Agent isolation or disabling
Audit logging that records the initiating person, acting agent, permission used, data accessed, tool invoked, action taken and outcome recommended

Control lifecycle: discover to revoke

Every agent should have an owner, a defined scope, a review cadence, a revocation path, and an expiry.

01Discover 02Inventory 03Classify 04Assess 05Approve 06Provision 07Monitor 08Review 09Respond 10Revoke or retire

continuous: discovery never stops

Phase	Primary owner	Required action	Expected evidence	Key failure mode	Relevant control
Discover	Security operations with IT asset management	Find every AI application, copilot, agent, model and workload in use today, including unapproved tools.	Discovery report with source of detection and first-seen date	Discovery is run once and treated as complete.	Continuous assessment rather than periodic surveys (P)
Inventory	Identity and access team with application owners	Record each item with business purpose, owners, connectors and data reach.	Inventory entry with named business and technical owner	A survey from last quarter is kept as if it were an inventory.	Living inventory maintained as an operating routine (P)
Classify	Data owners with privacy	Rate exposure, permissions and data reach; classify the data the agent may touch.	Risk classification and named data domains per agent	Sensitive data reach is assumed rather than confirmed.	Data classification and labeling (P)
Assess	Security architecture	Threat model the agent, its prompts, tools, connectors and retrieval paths.	Assessment record with test results and accepted risks	AI workloads are exempted from the standard applied to other critical workloads.	AI-specific threat modeling and testing (P)
Approve	Business owner, data owner, security and privacy	Decide whether this use case may connect to systems of record, and on what scope.	Approval record naming approvers, scope and expiry	Connection to a system of record happens without a data owner in the decision.	Approval before connecting AI to systems of record (P)
Provision	Identity and access team	Issue identity, credentials and least-privilege, time-bound access.	Entitlement grant with scope, justification and expiry	Pilot permissions become permanent standing access.	Least privilege with just-in-time access (P)
Monitor	Security operations	Collect agent, identity, application and data telemetry; detect misuse, injection and abnormal data pulls.	Telemetry coverage record and detection catalogue	SOC content assumes a human actor, so agent behavior is invisible.	Behavioral analytics and abnormal data pull detection (D)
Review	Identity and access team with business owner	Recertify permissions, scope and continued business need on a defined cadence.	Recertification record with decisions and exceptions	Review cadence exists on paper but not in the calendar.	Permission review and recertification (D)
Respond	Security operations with incident owners in identity, data, legal and privacy	Investigate human and machine actors on one timeline; contain the agent, not just the account.	Case record reconstructing person, agent, permission, data and action	Response plan disables a user account and leaves the agent acting.	Incident response procedures for agent containment (R)
Revoke or retire	Identity and access team with technical owner	Remove delegated authority, credentials and connectors when scope ends or expiry is reached.	Revocation record with time from decision to removal	Nobody is able to switch the agent off quickly.	Rapid revocation of delegated authority and agent isolation (R)

Phase

Primary owner

Required action

Expected evidence

Key failure mode

Relevant control

Discover

Security operations with IT asset management

Find every AI application, copilot, agent, model and workload in use today, including unapproved tools.

Discovery report with source of detection and first-seen date

Discovery is run once and treated as complete.

Continuous assessment rather than periodic surveys (P)

Inventory

Identity and access team with application owners

Record each item with business purpose, owners, connectors and data reach.

Inventory entry with named business and technical owner

A survey from last quarter is kept as if it were an inventory.

Living inventory maintained as an operating routine (P)

Classify

Data owners with privacy

Rate exposure, permissions and data reach; classify the data the agent may touch.

Risk classification and named data domains per agent

Sensitive data reach is assumed rather than confirmed.

Data classification and labeling (P)

Assess

Security architecture

Threat model the agent, its prompts, tools, connectors and retrieval paths.

Assessment record with test results and accepted risks

AI workloads are exempted from the standard applied to other critical workloads.

AI-specific threat modeling and testing (P)

Approve

Business owner, data owner, security and privacy

Decide whether this use case may connect to systems of record, and on what scope.

Approval record naming approvers, scope and expiry

Connection to a system of record happens without a data owner in the decision.

Approval before connecting AI to systems of record (P)

Provision

Identity and access team

Issue identity, credentials and least-privilege, time-bound access.

Entitlement grant with scope, justification and expiry

Pilot permissions become permanent standing access.

Least privilege with just-in-time access (P)

Monitor

Security operations

Collect agent, identity, application and data telemetry; detect misuse, injection and abnormal data pulls.

Telemetry coverage record and detection catalogue

SOC content assumes a human actor, so agent behavior is invisible.

Behavioral analytics and abnormal data pull detection (D)

Review

Identity and access team with business owner

Recertify permissions, scope and continued business need on a defined cadence.

Recertification record with decisions and exceptions

Review cadence exists on paper but not in the calendar.

Permission review and recertification (D)

Respond

Security operations with incident owners in identity, data, legal and privacy

Investigate human and machine actors on one timeline; contain the agent, not just the account.

Case record reconstructing person, agent, permission, data and action

Response plan disables a user account and leaves the agent acting.

Incident response procedures for agent containment (R)

Revoke or retire

Identity and access team with technical owner

Remove delegated authority, credentials and connectors when scope ends or expiry is reached.

Revocation record with time from decision to removal

Nobody is able to switch the agent off quickly.

Rapid revocation of delegated authority and agent isolation (R)

Control type: (P) preventive · (D) detective · (R) response.

Measurement panel: recommended metrics

The source contains no measurement values. Every metric below is a recommended measurement with neutral placeholders for the organization to populate.

Recommended metric	Current	Target	Trend
Percentage of AI applications and agents in the approved inventory	Current	Target	Trend
Percentage of agents with named business and technical owners	Current	Target	Trend
Percentage of agents with documented scopes and expiry dates	Current	Target	Trend
Percentage of agent permissions reviewed within the required period	Current	Target	Trend
Number of agents with standing privileged access	Current	Target	Trend
Number of unapproved AI applications discovered	Current	Target	Trend
Number of AI connectors linked to sensitive data	Current	Target	Trend
Percentage of AI interactions covered by appropriate logging	Current	Target	Trend
Number of abnormal data-access events	Current	Target	Trend
Mean time to revoke an agent's delegated authority	Current	Target	Trend
Percentage of AI workloads covered by posture and vulnerability management	Current	Target	Trend
Percentage of critical agent actions requiring human approval	Current	Target	Trend
Percentage of AI incidents for which the initiating human and acting machine identity can be reconstructed	Current	Target	Trend

Recommended metric

Current

Target

Trend

Percentage of AI applications and agents in the approved inventory

Current

Target

Trend

Percentage of agents with named business and technical owners

Current

Target

Trend

Percentage of agents with documented scopes and expiry dates

Current

Target

Trend

Percentage of agent permissions reviewed within the required period

Current

Target

Trend

Number of agents with standing privileged access

Current

Target

Trend

Number of unapproved AI applications discovered

Current

Target

Trend

Number of AI connectors linked to sensitive data

Current

Target

Trend

Percentage of AI interactions covered by appropriate logging

Current

Target

Trend

Number of abnormal data-access events

Current

Target

Trend

Mean time to revoke an agent's delegated authority

Current

Target

Trend

Percentage of AI workloads covered by posture and vulnerability management

Current

Target

Trend

Percentage of critical agent actions requiring human approval

Current

Target

Trend

Percentage of AI incidents for which the initiating human and acting machine identity can be reconstructed

Current

Target

Trend

Executive readiness questions

Evidence, not intent, is the test. A survey from last quarter is a memory, not an inventory.

Where is AI being used?

Credible answerA living inventory and a continuous assessment, not a survey.

Which agents can reach sensitive data?

Credible answerNamed data domains per agent.

Who governs AI permissions?

Credible answerAn owner, an approval, a revocation.

How are machine identities monitored?

Credible answerThe same lifecycle as employees.

How would AI abuse or prompt injection be detected?

Credible answerInjection, misuse and data pull alerts.

How is data exposure prevented?

Credible answerLabeling and data loss prevention at the AI layer.

Are AI workloads secured to the same standard as other critical workloads?

Credible answerPosture, vulnerability and identity coverage.

Who can immediately revoke an agent's authority? recommended

Credible answerA named role, a documented path and a measured time to revoke.

Can investigators reconstruct which person initiated an action and which agent executed it? recommended

Credible answerOne timeline covering human and machine actors.

If an AI system were misused tomorrow, would the organization see it and be able to stop it?

Credible answerDetection coverage plus a rehearsed containment step for agents.

Implementation roadmap

No new platform purchase and no reorganization is required to start. This is discipline applied to a new asset class.

0 to 90 days

Build the AI inventory

Discover every AI application, copilot, agent and workload in use today, including the ones nobody approved, and accept that the first version will be incomplete.

90 to 180 days

Govern agent access

Give every agent a named owner, a defined scope, a review cadence and a revocation path: the same lifecycle already applied to privileged accounts.

6 to 12 months

Extend security operations, posture management and detection to AI

Bring AI workloads and machine identities into posture management, vulnerability management and detection coverage.

Expected outcome

Every production agent has an owner, scope, review, revocation path, monitoring coverage, and expiry.

If an AI system were misused tomorrow, the organization would see it and be able to stop it.