# Agentic AI Security: Three Critical Questions

> Agentic AI security demands a new framework: runtime authorization, per-action blast radius, and decision chain observability.

**URL:** https://www.ciptadusa.com/blog/agentic-ai-security-framework-20260717  
**Type:** blog  
**Author:** PT Cipta Dua Saudara  
**Category:** Application Security  
**Published:** 2026-07-17  
**Cover:** https://cdn-uagents.enitip.com/uploads/blog/2026-07/daily-appsec-20260717-015406.jpg  

## Article

Agentic AI — systems that don't just answer questions but autonomously make decisions and execute actions — is already running in production. Dark Reading reports that the security questions we've been asking about conventional AI are no longer sufficient when agents can call APIs, write code, and modify infrastructure configurations without human intervention.

## Summary

Agentic AI security requires a new question framework focused on runtime authorization, per-action blast radius, and observability over decision chains — not just input validation and output filtering.

## The Challenge

Traditional AI models have a relatively defined attack surface: prompt injection, data poisoning, model inversion. Security teams can place guardrails on input (sanitization) and output (content filtering) because interactions are request-response.

Agentic AI inverts these assumptions. An agent tasked with "optimize our cloud spend" could — in a single execution chain — read billing data, analyze usage patterns, then **delete idle instances** or **modify security group rules**. Each step in the chain represents a different potential blast radius.

The question "can this model be jailbroken?" becomes irrelevant when the primary threat is not output manipulation, but **legitimate yet unintended autonomous actions** — what Dark Reading calls the "untamable" nature of agentic systems.

## Approach

Three security questions that must be added to assessment frameworks for agentic AI:

**What is the blast radius per action?** Every tool or API callable by the agent must be classified by reversibility and impact scope. Read-only operations (list instances, query logs) carry different risk profiles than write operations (delete resource, modify IAM policy). The principle of least privilege must be applied per-tool, not per-agent.

**How does runtime authorization work?** Static API keys granted at deployment are insufficient. Agents running for hours or days require scoped, time-limited credentials that are rotated. Every action chain must pass through a policy engine that evaluates whether a specific combination of actions remains within permitted bounds — not just whether one individual action is allowed.

**Is the decision chain observable?** When an agent makes 47 sequential decisions before executing a single action, security teams must be able to reconstruct the reasoning path forensically. This requires structured logging at every decision node, not just at the final action. Without this observability, incident response for agentic systems becomes impossible — you know *what* happened but not *why*.

## Implications

The industry is at a point where the agentic AI adoption curve exceeds the maturity of its security frameworks. Organizations already deploying agents in production — for code generation, infrastructure management, customer support escalation — need to immediately audit whether their security posture is still based on request-response assumptions, or already accommodates the reality of autonomous execution chains.

What makes this urgent: agentic AI that works "too well" can be as dangerous as compromised AI. An agent optimizing the wrong metric with high efficiency produces damage that is faster and wider than any manual attack.

## References

- [Agentic AI Is Untamable: Ask the Right Security Questions — Dark Reading](https://www.darkreading.com/cybersecurity-operations/agentic-ai-untamable-ask-the-right-security-questions)
- [OWASP Top 10 for LLM Applications 2025 — OWASP Foundation](https://owasp.org/www-project-top-10-for-large-language-model-applications/)
- [Securing Agentic AI: A Threat Model — NIST AI 600-1](https://www.nist.gov/artificial-intelligence)

---

*Markdown version of https://www.ciptadusa.com/blog/agentic-ai-security-framework-20260717 — generated for AI agents and LLM crawlers.*