Introduction
Agentic AI is reshaping how enterprises build, deploy, and operate technology. Autonomous agents are now capable of planning, acting, adapting, and coordinating with other systems — often without direct human initiation. These agents can analyze data, compose workflows, write or modify code, resolve errors, initiate transactions, and collaborate with other agents at a pace that exceeds traditional operational oversight.
For chief information officers, chief technology officers, technology and architecture delivery leaders, chief information security officers, and platform engineering teams, this shift represents both opportunity and disruption. Agentic AI promises accelerated development, intelligent automation, and new business capabilities. But it also introduces unprecedented complexity, new risk surfaces, and a governance burden that traditional controls were never designed to handle. The challenge is not simply securing a new tool but securing a fundamentally different computational model — one defined by autonomy, achieving objectives, and continuous decision-making.
To address this, Forrester developed the AEGIS framework — Agentic AI Enterprise Guardrails For Information Security. AEGIS provides the architectural and operational foundations required to deploy agentic AI safely and responsibly. It aligns governance, identity, data, application security, threat operations, and Zero Trust principles into a cohesive framework built specifically for this new class of systems.
This guide translates AEGIS into practical guidance for technology leaders responsible for architecting, delivering, and securing enterprise-grade AI systems. It outlines why agentic AI demands a new security paradigm, what the AEGIS framework includes, and how organizations can adopt it through a structured, phased approach.
Section 1:
Why Agentic AI Requires A New Enterprise Security Paradigm
As organizations scale their use of AI, many leaders initially assume that agentic systems can be governed with the same controls applied to traditional applications or generative AI copilots. But agentic AI behaves fundamentally differently: It introduces autonomy, intent formation, environmental adaptation, and multiagent collaboration. These characteristics shift the enterprise risk model from monitoring discrete actions to governing continuous, dynamic decision-making. Chief information security officers (CISOs) and other security and risk leaders must prepare for environments where agents act independently across distributed architectures, making it essential to rethink how risk, governance, and operational readiness are defined. This section outlines the forces driving that shift and sets the stage for why an updated AEGIS framework is necessary.
1.1 Agents Are Designed To Achieve Objectives
Agents are built to adapt. If they encounter an obstacle — an unavailable API, missing credentials, or a denied dataset — they will attempt alternative paths to achieve their objective. Without constraints, those alternative paths may involve accessing resources they shouldn’t, altering configurations unintentionally, or escalating privileges in ways that create operational and security risk.
Scenario example:
A research automation agent optimizing cloud compute usage might reroute workloads or reallocate GPU capacity without human approval, resulting in unexpected cloud costs. An optimization task intended to improve throughput could inadvertently disrupt critical workloads, creating a risk to continuity and service-level agreement compliance.
1.2 A Broader, Faster Attack Surface
Traditional applications interact with known systems through predictable flows. Agentic AI does not. Agents may simultaneously interface with databases, APIs, cloud resources, internal developer tools, customer-facing systems, and other agents. These interactions often occur at machine speed and across ephemeral workflows.
Most enterprises lack telemetry that captures prompt sequences, tool invocations, reasoning traces, or multiagent dependencies. This creates a visibility gap that attackers can exploit — and that technology leaders must close to ensure stability and trust.
1.3 Securing Intent, Not Just Actions
Legacy security models validate whether an action is allowed. In agentic environments, validating intent becomes equally essential. Because agents generate plans independently, a seemingly valid action such as querying customer data may be taken for an unintended or risky reason.
Without monitoring intent, attackers can manipulate agent objectives through prompt injection, data poisoning, or subtle contextual framing that bypasses traditional guardrails.
1.4 Cascading Failures Across Interconnected Agents
Agents frequently rely on one another. A single hallucinated assumption, corrupted data element, or incorrect step can propagate across interconnected workflows, making small errors scale rapidly.
Scenario example:
If a supply chain agent misinterprets a signal as increased demand, it could trigger procurement workflows that propagate across finance, fulfillment, and inventory systems — generating systemic disruptions.
1.5 Infinite, Ephemeral, And Autonomous Scaling
Agents can spawn additional agents or initiate new processes to complete tasks. They scale faster than human oversight can track, creating operational load on both architecture and security teams. The problem is no longer approving individual actions but governing thousands of autonomous micro decisions.
1.6 Opaque Causal Provenance
Agent reasoning often involves branching logic, internal state transitions, and multistep transformations. When failures occur, reconstructing why becomes difficult without robust, specific agent logging. Traditional logs cannot trace reasoning chains, making forensics, compliance, and root-cause analysis far more complex.
Together, these characteristics make legacy security and governance insufficient. AEGIS introduces the foundational guardrails required to govern autonomy at scale.
Section 2:
Inside Forrester’s AEGIS Framework
Each domain within the AEGIS framework is designed to anchor a specific dimension of agentic AI security — governance, identity, data, applications, threat response, and Zero Trust — but their true strength emerges in how they interlock. Agentic systems blur traditional boundaries across teams, infrastructure layers, and control surfaces. As a result, enterprises can no longer treat identity, data protection, DevSecOps, and threat monitoring as isolated disciplines. The AEGIS framework unifies these capabilities into a shared operating model that scales with autonomy, ensures repeatable guardrail enforcement, and reduces fragmentation across security and delivery functions. The next subsections break down these six domains and explain the role each plays in an agentic AI security posture.
2.1 Governance, Risk, And Compliance (GRC)
GRC becomes the strategic foundation of agentic AI because autonomy demands continuous oversight. Point-in-time audits and static policies cannot manage systems that reason and act independently.
AEGIS GRC guidance includes:
- Real-time risk and compliance monitoring
- Automated detection of behavior drift
- Cross-functional risk mapping
- Policy-as-code guardrails to enforce machine-executable policies
Scenario example:
If an agent begins generating access requests outside expected business hours or in unexpected locations, dynamic compliance rules can automatically pause activity, escalate alerts, or route for human approval.
2.2 Identity And Access Management (IAM)
Agentic AI introduces a new class of identity: autonomous, adaptive, and short-lived. IAM must evolve to treat agents as first-class entities with ownership, credentials, lifecycle management, and auditability.
Key IAM shifts include:
- Agents as managed identities
- Standards-based integration (OAuth, OIDC, SAML, SCIM)
- Model Context Protocol (MCP) for audited access interactions
- Just-in-time, least-agency authorization
While MCP plays an important role in agent identity and access control, AEGIS does not rely on any single protocol or technology. Secure agentic systems require coordinated controls across governance, IAM, data security, application security, threat operations, and Zero Trust architecture.
Scenario example:
A procurement agent executing multisystem workflows must not inherit admin privileges simply because the process spans multiple systems. OBO (on-behalf-of) chains preserve scope boundaries.
2.3 Data Security And Privacy
Agents continuously ingest, generate, and transform data. Without unified data governance, they may inadvertently aggregate or expose sensitive information.
AEGIS data security guidance includes:
- Unified definitions of sensitive data
- Purpose-bounded data access
- Expanded data security posture management (DSPM), data loss prevention (DLP), and digital asset management (DAM) for agent actions
- Privacy-preserving techniques such as masking, encryption, and synthetic data
Scenario example:
A churn prediction agent analyzing user activity might accidentally incorporate regulated personally identifiable information from a restricted dataset if segmentation policies aren’t applied to agent-generated requests.
2.4 Application Security And DevSecOps
Agents generate code, orchestrate cloud resources, and make architectural changes. This turns the entire software supply chain into part of the agentic threat surface.
Guidance includes:
- AI-specific threat modeling
- Rigorous validation of agent-generated code
- Software bills of materials and AI bills of materials for provenance
- Secure prompt engineering
- Continuous observability across the agent lifecycle
Scenario example:
A performance-optimization agent may propose code changes that introduce vulnerabilities if automated scanning and review pipelines aren’t applied consistently.
2.5 Threat Management And Security Operations
SecOps must shift from monitoring user behavior to monitoring agent reasoning patterns, tool calls, and emergent anomalies.
AEGIS threat management includes:
- Detailed logging of prompts, actions, reasoning steps, and errors
- Detection for prompt injection, hallucinations, and drift
- Purple teaming for agent behaviors
- Automated response playbooks tied to agent actions
Scenario example:
If an agent retries a denied API call repeatedly, SecOps must determine whether the behavior indicates a malfunction, incomplete training, or manipulation.
2.6 Zero Trust Architecture
AEGIS extends Zero Trust to enforce least agency — controlling not just what an agent can access but what decisions it is allowed to make.
Guidance includes:
- Microsegmentation to isolate agents when anomalies occur
- API gateways and access brokers for enforcement and telemetry
- Privilege and objective constraints
- Network-level containment to preserve evidence
Section 3:
Modernizing IAM For Agentic AI
In agentic ecosystems, identity becomes more than a security construct — it becomes the mechanism for shaping and constraining an agent’s operational boundaries. Unlike human identities, which map to predictable behaviors, agent identities must account for continuous decision loops, rapid scaling, ephemeral processes, and multiagent collaboration. Traditional IAM systems, which rely on static entitlements and coarse-grained controls, cannot keep pace with autonomous workflows that generate tool calls and system interactions in milliseconds. CISOs and security and risk leaders will need identity architectures capable of enforcing least agency, preserving intent, and providing real‑time control across federated environments. The following subsections describe the essential IAM components required to govern agentic AI safely and effectively.
3.1 AI Agents As Identities With Owners And Lifecycles
Agents require:
- Accountable human owners
- Credential vaulting and rotation
- Provisioning/deprovisioning workflows
- Full audit trails
AEGIS emphasizes scaled discovery, cataloging, and identity lifecycle governance for thousands of short-lived agents.
3.2 Standards As The Foundation
Repeatable, interoperable architectures require standards — not custom integrations.
AEGIS highlights:
- OAuth, OIDC, SAML, SCIM
- Shared Signals Framework and Continuous Access Evaluation
- Decentralized identifiers
- MCP for consistent agent-resource interactions
3.3 Authentication In An Agentic World
Human and agent authentication diverge.
Humans require identify verification and multifactor authentication, but a
gents require:
- Vaulted credentials
- Per-session authentication
- Quantum-safe encryption
- Privileged access rotation
3.4 Authorization: Delegation, Context, And Least Agency
Authorization must constrain decision scope.
AEGIS emphasizes:
- OBO delegation models
- Context-aware, risk-based authorization
- Just-in-time permissions
- Micro authorizations limited by purpose
Section 4:
Implementing AEGIS Across the Enterprise
Implementing the AEGIS framework is not a single initiative — it is an organizational capability shift. Most enterprises already have pockets of AI adoption, but few have the governance maturity, identity foundations, or observability layers required for safe autonomy at scale. A phased approach allows organizations to strengthen foundational controls before layering in more advanced capabilities such as least agency enforcement and multiagent telemetry. By sequencing changes across governance, IAM, data security, DevSecOps, and Zero Trust, CISOs and security and risk leaders can reduce operational friction, avoid overengineering, and build confidence across business stakeholders. The phases below reflect how organizations typically progress as they move from experimentation to enterprisewide agentic AI security.
Phase 1: Establish Governance (0–3 Months)
- Define agentic risk frameworks
- Build dynamic compliance monitoring
- Implement policy-as-code guardrails
- Document agent objectives and acceptable-use boundaries
Phase 2: Modernize IAM And Data Security (3–6 Months)
- Classify agents as identities
- Deploy MCP-based architectures
- Consolidate sensitive-data definitions
- Expand DSPM, DLP, and DAM coverage
Phase 3: Secure The Agent Lifecycle (6–12 Months)
- Apply AI-specific threat modeling
- Validate agent-generated code in continuous integration and delivery
- Build end-to-end traceability
- Monitor hallucinations, drift, and behavioral anomalies
Phase 4: Mature With Zero Trust (12+ Months)
- Implement least-agency constraints
- Enforce API-level guardrails
- Deploy microsegmentation for containment
- Build shared multiagent telemetry
Conclusion
Agentic AI introduces autonomy that transforms enterprise technology’s operating model. With this transformation comes new complexity, new dependencies, and new risks — requiring a framework purpose-built for autonomous decision-making. The Forrester AEGIS framework gives enterprises the guardrails needed to adopt agentic AI safely while enabling innovation, resilience, and long-term scalability.
Frequently Asked Questions
1. Why do AI agents need their own identity class?
Because agents behave neither like human users nor machine accounts. Their autonomy and rapid, ephemeral operation require dedicated identity models and governance.
2. How does AEGIS differ from traditional Zero Trust?
Zero Trust limits access. AEGIS introduces least agency, limiting the decisions and actions agents can take — even when access is granted.
3. What risks make agentic AI uniquely challenging for security teams?
Behaviors that achieve objectives, intent hijacking, multiagent cascades, opaque decision paths, and machine-speed escalation all exceed what traditional controls can manage.
4. Why is MCP so important for agent security?
MCP standardizes and audits how agents access tools and resources, enabling consistent, enforceable access patterns within IAM architectures.
5. What should organizations focus on first when adopting AEGIS?
Start with governance and policy as code to establish acceptable behavior boundaries before scaling deployments.
6. How can agent-caused incidents be investigated?
Through complete logging of prompts, actions, and reasoning steps paired with multistep traceability across agents and systems.
7. What does least agency look like in practice?
It gives an agent only the minimum decision scope and capability required for its task, bounded by time, context, and role.
Contact us today.
Thank you!
Ready to learn more now? Give us a call:
Americas: +1 615.395.3401
EMEA: +44 (0) 2073 237741
Asia Pacific: +65 6426 7060