Agentic AI

From answering to acting

A language model answers. An agent acts. The difference is not the model, which may be the same one, but what has been wired around it: a loop that lets the model plan a sequence of steps, call tools such as a search index, a database, an email client or another agent, read what comes back, and decide what to do next until it judges the goal met. Agentic AI is the term for systems built that way.

That changes what an organisation is governing. With a chatbot, the worst case is a wrong or harmful answer that a person then reads. With an agent, the worst case is a wrong or harmful action that has already happened by the time anyone reads anything: an email sent, a record changed, a payment initiated, a file deleted. The unit of risk is no longer one output. It is a chain of actions, each of which was chosen by a component that cannot reliably tell instructions from data.

Why the old controls do not transfer cleanly

Three things that work for a conventional system work badly for an agent.

Identity and access. Most organisations give an agent a service account, which means standing permissions with no task boundary, or run it under a user's own identity, which means the audit trail cannot tell what the person did from what the agent did on their behalf. Neither is what least privilege means. The principle that fits is sometimes called least agency: the minimum autonomy, the minimum tool access and the minimum credential scope the task needs, granted for that task and withdrawn afterwards.

Human oversight. A review step at the end of a chatbot exchange reviews the only thing that matters. A review step at the end of an agent run reviews a summary of actions that have already taken effect. Oversight has to sit at the points where an action becomes irreversible, which means deciding in advance which actions those are.

Testing. A model's behaviour on a fixed prompt set says little about an agent, because the agent's behaviour depends on what its tools return, and an attacker who controls any of that content controls the agent. Indirect prompt injection is the delivery mechanism; excessive agency is what makes it consequential.

The vocabulary that is settling

The field is young enough that terms are still moving, but a working set has emerged, and most of it maps to a control this site already describes.

• Tool use or function calling: the mechanism by which a model invokes something outside itself. Every tool is an entry point for untrusted content and an exit point for consequential action.
• Agent identity: a way to authenticate an agent as an agent, distinct from any human, so that its actions are attributable to it and its permissions can be scoped to it.
• Delegation: the record that links an agent's actions back to the person or process that authorised it, so accountability survives automation.
• Checkpoints or approval gates: the named actions an agent must pause on for a person to confirm. Human-in-the-loop review, applied per action rather than per conversation.
• Multi-agent systems: agents that call other agents. Every concern above compounds, and the audit trail has to survive the hand-offs.

Standards bodies are catching up. NIST opened an AI agent standards initiative in early 2026, with work on agent identity and authorisation and on security control overlays for single- and multi-agent systems; OWASP's 2026 LLM Top 10 moved excessive agency up to third place. Neither is finished, and an organisation deploying agents now is governing ahead of the guidance.

What to ask before deploying one

Five questions, in the order they usually go wrong.

• Which actions can this agent take that cannot be undone, and which of those require a person to confirm first?
• What content reaches the agent that we do not control, and what happens if that content contains instructions?
• Under whose identity does it act, and can the audit trail distinguish its actions from theirs?
• What is the blast radius if it runs unattended for an hour with a wrong goal, and what stops it?
• Who owns it, and would they know within a day if it started behaving differently?

An agent that cannot answer the first question should not have write access to anything. Most of the rest is inadequate human oversight design with the automation turned up.

The reference points since late 2025

Agent governance now has shared reference points.

• OWASP's Top 10 for Agentic Applications (December 2025) lists the risks specific to agents, from goal hijack to rogue agents; see OWASP Top 10 for Agentic Applications.
• Careful Adoption of Agentic AI Services (May 2026), joint guidance from six national cyber security agencies including the UK's NCSC, recommends graduated deployment: start with low-risk uses, expand autonomy only as confidence grows, and design every deployment to be reversible. It calls prompt injection the most persistent threat to agents.
• NIST's AI Agent Standards Initiative (February 2026) is working on agent security, identity and interoperability.

The integration layer has standardised too. Most agents now connect to tools through the Model Context Protocol, and every connected server is a trust boundary. The quickest test of an agent design is the lethal trifecta.

Where it sits in the register

Excessive agency in autonomous agents is the register entry for the defining risk: an agent with more permission, autonomy or tool access than its task needs. Prompt injection is how an attacker gets a goal into it, and improper output handling is what lets the agent's output become an action without a check. On the control side, human-in-the-loop review at the irreversible steps, output validation guardrails between the model and every tool, inference usage quotas and rate limiting to bound what an unattended run can do, and AI system monitoring and logging so that the record of what the agent did exists before anyone needs it.