--- title: Agentic AI Security: Risks, Controls & Framework | daily.dev description: Agentic AI security is framed as bounding what a full sequence of autonomous steps can reach, not just checking individual actions. OWASP's Agentic Security... canonical: https://daily.dev/posts/agentic-ai-security-risks-controls-framework-richrgmlz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Agentic AI Security: Risks, Controls & Framework | daily.dev og:description: Agentic AI security is framed as bounding what a full sequence of autonomous steps can reach, not just checking individual actions. OWASP's Agentic Security... og:url: https://daily.dev/posts/agentic-ai-security-risks-controls-framework-richrgmlz og:image: https://api.daily.dev/og/posts/RIChrgMlz.png og:image:alt: Agentic AI Security: Risks, Controls & Framework og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Agentic AI Security: Risks, Controls & Framework **[Orca Security Blog](https://daily.dev/sources/orca-security-blog)** · 16 min read · 1 upvotes · 0 comments ## Summary Agentic AI security is framed as bounding what a full sequence of autonomous steps can reach, not just checking individual actions. OWASP's Agentic Security Initiative catalogs seventeen threats (T1-T17) in its v1.1 guide, grouped around five structural properties of autonomous execution: the action gap, compounding plans, runtime trust boundaries, non-determinism, and the absence of a decision-time human. Traditional identity assumptions (bounded sessions, per-action consent, step-up challenges) break down for agentic systems, requiring substitutes like run identifiers, step-level logging, and reversibility-tiered approval thresholds. Recommended controls operate at the run level: action classes with approval thresholds, blast-radius caps, step/time/cost budgets, a named stop-mechanism owner, egress boundaries, and replayable records. Delegation across agent chains and orchestrators as trust boundaries are highlighted as key risk areas, with token exchange (RFC 8693) recommended over blind token forwarding. A platform capability checklist and FAQ section round out the guidance, alongside a pitch for Orca's cloud-side AI security posture management. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many agentic AI threats does OWASP's Agentic Security Initiative catalog and in what version? OWASP's Agentic Security Initiative catalogs seventeen threats, labeled T1 through T17, in version 1.1 of its Agentic AI Threats and Mitigations guide, published December 2025. Earlier versions listed only fifteen threats, so the taxonomy version should be checked before citing specific threat numbers, since threat IDs have shifted between releases. _Teams building agent security programs can track evolving threat taxonomies like this one on daily.dev._ ### What controls should apply to an entire agentic AI run rather than individual steps? Six run-level controls are recommended: action classes with reversibility-tiered approval thresholds, blast-radius caps limiting how many objects a run may modify, step/time/cost budgets, a stop mechanism with a named owner that operates in seconds, network egress boundaries limiting reachable destinations, and replayable per-step records of inputs, tools, and identity used for monitoring drift. _Engineers designing agent guardrails can follow control patterns like these on daily.dev._ ### Why does forwarding an authentication token to a sub-agent in a delegation chain create security risk? Forwarding a token widens authority by default because the downstream service cannot distinguish the agent's own capability from the user's delegated rights, letting a sub-agent perform actions under authority nobody explicitly evaluated. Token exchange under RFC 8693 narrows authority instead, issuing downstream tokens with structured claims representing both the agent and the upstream principal. _Developers securing multi-agent delegation chains can dig into token exchange patterns via daily.dev._ ## Similar posts on daily.dev - [From guardrails to governance: A CEO’s guide for securing agentic systems](https://daily.dev/posts/from-guardrails-to-governance-a-ceo-s-guide-for-securing-agentic-systems-nwyvrgrec) · MIT Technology Review · 0 upvotes · 0 comments - [10 Very Real Risks of Agentic AI](https://daily.dev/posts/10-very-real-risks-of-agentic-ai-zoojuha9d) · Nordic APIs · 0 upvotes · 0 comments - [Managing agentic AI risk: Lessons from the OWASP Top 10](https://daily.dev/posts/managing-agentic-ai-risk-lessons-from-the-owasp-top-10-dkauj1rfw) · CSO Online · 1 upvotes · 0 comments - [Agentic AI risks and challenges](https://daily.dev/posts/agentic-ai-risks-and-challenges-dznefhutn) · Domino Data Lab · 3 upvotes · 0 comments - [The Next Security Battleground: Agentic Identity](https://daily.dev/posts/the-next-security-battleground-agentic-identity-nvsuarfg5) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloud](https://daily.dev/tags/cloud), [#ai-security](https://daily.dev/tags/ai-security), [#agentic-ai](https://daily.dev/tags/agentic-ai) [View this post on daily.dev](https://daily.dev/posts/agentic-ai-security-risks-controls-framework-richrgmlz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Agentic AI Security: Risks, Controls & Framework","url":"https://daily.dev/posts/agentic-ai-security-risks-controls-framework-richrgmlz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/agentic-ai-security-risks-controls-framework-richrgmlz"},"datePublished":"2026-08-14T18:05:25.474Z","dateModified":"2026-09-14T08:06:20.420Z","description":"Agentic AI security is framed as bounding what a full sequence of autonomous steps can reach, not just checking individual actions. OWASP's Agentic Security...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5a33d4d7995970fb3f85faf19e16c8f4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5a33d4d7995970fb3f85faf19e16c8f4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Orca Security Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Orca Security Blog","logo":"https://media.daily.dev/image/upload/s--kkQFNboJ--/f_auto,q_auto/v1780213281/logos/orca-security-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/orca-security-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/agentic-ai-security-risks-controls-framework-richrgmlz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloud,ai-security,agentic-ai","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Orca Security Blog","item":"https://daily.dev/sources/orca-security-blog"},{"@type":"ListItem","position":3,"name":"Agentic AI Security: Risks, Controls & Framework"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/agentic-ai-security-risks-controls-framework-richrgmlz#faq","mainEntity":[{"@type":"Question","name":"How many agentic AI threats does OWASP's Agentic Security Initiative catalog and in what version?","acceptedAnswer":{"@type":"Answer","text":"OWASP's Agentic Security Initiative catalogs seventeen threats, labeled T1 through T17, in version 1.1 of its Agentic AI Threats and Mitigations guide, published December 2025. Earlier versions listed only fifteen threats, so the taxonomy version should be checked before citing specific threat numbers, since threat IDs have shifted between releases. Teams building agent security programs can track evolving threat taxonomies like this one on daily.dev."}},{"@type":"Question","name":"What controls should apply to an entire agentic AI run rather than individual steps?","acceptedAnswer":{"@type":"Answer","text":"Six run-level controls are recommended: action classes with reversibility-tiered approval thresholds, blast-radius caps limiting how many objects a run may modify, step/time/cost budgets, a stop mechanism with a named owner that operates in seconds, network egress boundaries limiting reachable destinations, and replayable per-step records of inputs, tools, and identity used for monitoring drift. Engineers designing agent guardrails can follow control patterns like these on daily.dev."}},{"@type":"Question","name":"Why does forwarding an authentication token to a sub-agent in a delegation chain create security risk?","acceptedAnswer":{"@type":"Answer","text":"Forwarding a token widens authority by default because the downstream service cannot distinguish the agent's own capability from the user's delegated rights, letting a sub-agent perform actions under authority nobody explicitly evaluated. Token exchange under RFC 8693 narrows authority instead, issuing downstream tokens with structured claims representing both the agent and the upstream principal. Developers securing multi-agent delegation chains can dig into token exchange patterns via daily.dev."}}]} ```