Agentic AI security is framed as bounding what a full sequence of autonomous steps can reach, not just checking individual actions. OWASP's Agentic Security Initiative catalogs seventeen threats (T1-T17) in its v1.1 guide, grouped around five structural properties of autonomous execution: the action gap, compounding plans, runtime trust boundaries, non-determinism, and the absence of a decision-time human. Traditional identity assumptions (bounded sessions, per-action consent, step-up challenges) break down for agentic systems, requiring substitutes like run identifiers, step-level logging, and reversibility-tiered approval thresholds. Recommended controls operate at the run level: action classes with approval thresholds, blast-radius caps, step/time/cost budgets, a named stop-mechanism owner, egress boundaries, and replayable records. Delegation across agent chains and orchestrators as trust boundaries are highlighted as key risk areas, with token exchange (RFC 8693) recommended over blind token forwarding. A platform capability checklist and FAQ section round out the guidance, alongside a pitch for Orca's cloud-side AI security posture management.
Table of contents
Understanding Agentic AI and Its Security ImplicationsWhy Agentic AI Introduces New Security ChallengesTop Agentic AI Security Threats and RisksHow Agentic Systems Differ from Traditional UsersKey Principles and Frameworks for Securing Agentic AI SystemsAgentic AI Security Controls and Best PracticesIdentity Security and Orchestration in Agentic SystemsBuilding a Comprehensive Agentic AI Security PlatformHow Orca Secures the Cloud Environment Agentic Systems Operate InFrequently Asked Questions about Agentic AI SecurityQuestions this post answers
How many threats does OWASP's Agentic AI Threats and Mitigations guide currently catalog?
OWASP's Agentic Security Initiative catalogs seventeen threats, labeled T1 through T17, in version 1.1 of its Agentic AI Threats and Mitigations guide released in December 2025. Earlier versions of the taxonomy listed only fifteen threats, so the version should be checked before citing a specific count or threat number. Security teams tracking evolving AI threat taxonomies can follow updates like this on daily.dev.
What controls should apply to an entire agentic AI run rather than just individual steps?
Six run-level controls are recommended: action classes with approval thresholds tied to reversibility and blast radius, blast-radius caps limiting how many objects one run can modify, step/time/cost budgets, a stop mechanism with a named owner who can halt execution in seconds, network egress boundaries limiting reachable destinations, and replayable per-step records for monitoring drift. Anyone designing guardrails for autonomous agents can track practical control patterns like these on daily.dev.
Why is forwarding a user's access token to a sub-agent risky in a multi-agent delegation chain?
Forwarding a token widens authority by default because the downstream service cannot distinguish the agent's own capability from the user's delegated rights, letting a sub-agent act under authority nobody explicitly evaluated. Token exchange under RFC 8693 narrows authority instead by issuing downstream tokens carrying structured claims that represent both the agent and the upstream principal. Developers architecting multi-agent delegation chains can dig into identity patterns like token exchange on daily.dev.