The CISO's Guide to Securing Agentic AI

An autonomous agent with broad permissions can traverse systems, invoke APIs, read sensitive data, and trigger workflows, all within a single session, all without a human in the loop. Fortune 50 pharma organizations have found 2,000+ agent instances shared across their footprint, 82% built by people who aren't professional developers.
This isn't a hypothetical cyberattack scenario. A developer clicking through approval prompts without reading them, or an agent hallucinating its way into deleting a production service, are routine exposures, not edge cases.

A customer service agent with clean, least-privilege credentials can be redirected mid-session by an indirect prompt injection hidden in a document, then begin exfiltrating records while every access-control signal stays green. Zenity Labs has documented this pattern in production; in the PleaseFix attack family, a single malicious calendar invite let a compromised agent take over a credential vault with zero clicks from the victim.
IAM answers "was this permitted?" It was never designed to answer "was this, in this sequence, consistent with what the agent is supposed to be doing?"

Most enterprise tooling gives you execution observability (EO): access logs, credential records, what happened. Almost none of it gives you intent observability (IO): what the agent was reasoning about, what context shaped that reasoning, and whether the resulting action made sense.
That gap between EO and IO is where sophisticated patient attacks and honest agent mistakes hide undetected until the damage is done.

Coverage gaps compound: identity-only misses gradual, sub-threshold exfiltration; data-only can't attribute or explain intent; posture-only misses runtime manipulation. Assembled together at runtime, the five signals answer what authorization alone cannot: not just what the agent was allowed to do, but whether what it did made sense.
The five signals are: Identity (the agent's active identity layer), Data (what it actually touched), Cognition (drift, manipulation, or hallucination), Posture (build-time configuration), Environment (where it is operating).

Intent-aware security evaluates not just what an agent did, but whether it was consistent with what it was supposed to do, derived from actual behavioral baselines, not just a declared purpose statement that can go stale or be manipulated.
Because intent evaluation is multi-step, the right response is rarely binary. Mature programs need a full spectrum: logging, elevated scrutiny, human approval, single-step blocking, step rewriting, workflow suspension, and full kill switch.

Today's agent authorization mostly layers ABAC/PBAC execution controls on strong authentication. Intent-aware Zero Trust doesn't replace existing Zero Trust investments, such as network access, identity verification, and microsegmentation. It adds the behavioral verification layer agentic environments require on top of them.

The on-behalf-of problem exists in even the simplest agent deployment, not just complex multi-agent chains. When an orchestrator delegates to sub-agents, a user is implicitly trusting an entire chain they can't see and never authorized hop by hop. Each additional link compounds autonomous decision scope: governing that chain means scoping and shrinking the autonomy budget at every hop.

Least privilege defines the outer limit of what the agent can reach. It answers: "What can this agent access?" Least agency scopes what the agent does inside that limit. It answers: "What actions, in what sequence, under what oversight?"

Least privilege remains necessary. An agent shouldn't hold permissions beyond its task, and fixing over-permissioned agents is a high-value quick win. But an agent can stay entirely within its permitted scope and still behave inappropriately. Least agency fills that gap: it constrains behavior, not just reach, and applies from an agent's very first execution, before any behavioral history exists.

Agent inventory is the prerequisite for every other control. You can't apply identity governance, monitor behavior, or maintain audit trails for agents you never formally recorded, including shadow deployments found only through active scanning.

Every agent needs a named, accountable business owner, not a platform vendor, and should be integrated into existing ITAM/CMDB processes rather than governed in a parallel structure.

GDPR, CCPA, and HIPAA apply to agent-initiated data access the same as human access. The EU AI Act and NIST AI RMF are both moving toward requiring evidence of behavioral monitoring, not just access logs. Auditors will ask not just what an agent was permitted to do, but what it actually did and how you know it was appropriate.

Singapore's 2026 Model AI Governance Framework for Agentic AI is one of the most detailed early frameworks addressing this directly.

A complete behavioral record serves three purposes: real-time detection of anomalies as they happen, forensic reconstruction to answer what happened and why, and compliance documentation proving behavior matched declared intent.

Every agent action should trace back to a human: the user it acted for, the owner who deployed it, or both. Otherwise, incident response is left correlating accountability from telemetry that was never built to answer that question.

Detection alone doesn't stop an incident in progress. Containment requires kill-switch capability that spans heterogeneous environments, including Copilot Studio, Agentforce, ServiceNow, and custom frameworks, from a single control plane, plus response and recovery playbooks built specifically for agentic incidents rather than adapted from traditional IR.

That reframing is the conceptual shift boards need. "The access was granted, the activity was technically permitted, but the outcome was a breach" is a difficult liability argument, and boards understand liability. Red flags to escalate: unsanctioned high-permission agents, agents accessing data inconsistent with declared purpose, AI-governance regulatory inquiries, and material third-party agent incidents.

Most organizations show strong identity coverage from years of IAM investment, and weak behavioral or intent coverage since agentic deployments are new. A sixth dimension deserves equal attention: proactive exposure management, or reducing an agent's potential scope before deployment rather than only reacting after an incident.

Point solutions that solve only the access question leave behavioral risk unaddressed and push manual signal correlation onto security teams. The strongest platforms integrate with existing IAM, PAM, and SIEM investments and bring active threat research to keep pace with fast-evolving attack techniques.

Zenity's platform is built to cover this evaluation end to end: unified observability, governance, and threat protection for SaaS-managed, device-based, and home-grown agents across the enterprise.

NIST CAISI, the AI Safety Institute, the EU AI Act, and international frameworks are converging on the same principles: agents need explicitly bounded identities, fully auditable delegation chains, behavioral monitoring as a baseline for production, and human oversight that's designed rather than assumed.

CISOs who engage with standards bodies now, rather than waiting to implement what others shape, end up better positioned, as happened with cloud security and supply-chain security before this.

Building intent-governed AI into the security program is a leadership role that reaches beyond security: working with business owners on scope, legal on regulatory alignment, engineering on controls, and the board on visibility. The organizations that get this right aren't the ones who avoided agentic AI's risks; they're the ones who accepted the risks were real and built the governance to manage them.