Agentic security glossary
More than 30 precise definitions across AI agent identity, MCP security, governed tool use, credential controls, runtime policy, and audit.
Secure Agent Runtime
The infrastructure layer between an AI agent and the APIs it calls.
A secure agent runtime is the infrastructure layer that sits between an AI agent and the downstream APIs it needs to call. Instead of giving the agent a credential, the runtime receives the agent's intent, validates it against policy, injects the credential at execution time, performs the API call, and returns only the response. The agent never holds the key. KeyRunner is purpose-built as a secure agent runtime for enterprise API execution.
Non-Human Identity (NHI)
Cryptographic or token-based identity for AI agents and automated systems.
Non-human identity (NHI) refers to the cryptographic or token-based identities assigned to AI agents, bots, CI/CD pipelines, and other automated systems, so those systems can authenticate to other services without relying on a human credential. NHI establishes who is calling. It does not govern what that caller is allowed to do with downstream API credentials after authentication. A complete agentic security stack requires both NHI and an execution governance layer.
Credential Injection at Runtime
Fetching and using a secret at execution time without distributing it to the caller.
Credential injection at runtime means retrieving a secret from a vault or key management system at the moment of API execution, not before, not stored in config, not passed to the calling agent. The credential is used to make the API call and then discarded. The agent or developer that initiated the call never receives the credential value. This eliminates standing credentials in agent context, memory, prompts, and logs.
MCP Security
Security controls over tools defined and called via the Model Context Protocol.
MCP (Model Context Protocol) is an open standard that defines how AI models discover and invoke tools. MCP security refers to the policies, access controls, and audit mechanisms that govern those tool calls, what tools can be called, by which agents, under what conditions, and with what credentials. An MCP-compatible secure agent runtime intercepts tool calls, enforces policy, handles credential injection, and logs execution before the underlying API request is made.
Governed Agent Execution
Agent API calls that are policy-checked, credential-safe, and fully audited.
Governed agent execution describes an architecture where every API action taken by an AI agent is validated against a defined policy before execution, performed without the agent holding a live credential, and recorded in an immutable audit trail. It is the operational outcome of deploying a secure agent runtime. Governed execution means agents can be given broad capability without the security risk of broad credential access.
Excessive Agency (OWASP LLM08)
The risk of an AI agent taking unintended high-impact actions due to over-permissioning.
Excessive agency is OWASP's LLM08 risk, the condition where an AI agent has been granted more capability, permissions, or access than it needs to perform its intended function. When an agent has direct access to API credentials, excessive agency becomes exploitable: a compromised, misdirected, or prompt-injected agent can take actions far beyond its intended scope. Removing credentials from agent context and enforcing per-action policy eliminates the primary attack surface of excessive agency.
Agentic API Security
Security controls specifically designed for AI agents calling external APIs.
Agentic API security is the discipline of securing the API calls made by AI agents, as distinct from securing APIs against human callers. Human API security is solved by gateways, rate limiting, and OAuth flows. Agentic API security requires additional controls: preventing credential exposure in agent context, enforcing policy on what actions agents can take (not just whether they can authenticate), and maintaining audit trails for autonomous agent actions that may span many calls across many systems.
Runtime Policy Enforcement
Blocking unauthorized agent actions at execution time, before the API call is made.
Runtime policy enforcement means evaluating whether an action is permitted at the moment it is attempted, not configuring permissions ahead of time and trusting the caller to respect them. In agentic architectures, this means intercepting each API call intent, checking it against a policy that defines which agents may call which APIs under what conditions, and either executing or blocking the call before any credential is retrieved or any network request is made. Policies enforced at runtime cannot be bypassed by a compromised agent.
Zero-Trust Agent Execution
Never trusting an agent implicitly, every API call verified by policy at runtime.
Zero-trust agent execution applies zero-trust principles to AI agent behavior: no agent is trusted by default, every API call is verified against explicit policy, credentials are never distributed to agents, and access is granted only for the specific action requested. This is distinct from zero-trust network architecture (ZTNA), which governs network-layer access. Zero-trust agent execution governs application-layer actions taken by autonomous AI systems.
API Tool Governance
Controlling which agents can call which API tools, and under what policy.
API tool governance is the management layer that defines, enforces, and audits the conditions under which AI agents may use registered API tools. It includes tool registration (what actions exist), access policy (who may call each tool), runtime controls (credential injection, rate limits, conditional access), and observability (audit trails, anomaly detection). API tool governance is what separates a governed agent from an agent with unchecked API access.
AI Agent Identity
A verifiable identity assigned to an AI agent for authentication and policy.
AI agent identity is the set of verifiable attributes used to distinguish one agent from another and connect its actions to an owner, workload, user, purpose, and policy. Identity establishes which agent is requesting access. Execution governance determines whether the specific requested tool action is allowed.
Workload Identity
A machine identity for an application, service, process, or AI agent.
Workload identity is a cryptographically verifiable identity used by software workloads such as applications, services, scripts, containers, and AI agents. It enables a receiving system to authenticate the calling workload without relying on a shared human account.
Non-Human Identity Posture Management
Discovering and reducing identity risk across machine and agent accounts.
Non-human identity posture management is the continuous discovery, ownership mapping, risk assessment, permission analysis, and remediation of service accounts, API keys, workloads, bots, and AI agent identities. It helps teams find excessive, stale, orphaned, or poorly governed access.
Least-Privilege Agent Access
Giving an agent only the tools, data, and conditions required for its task.
Least-privilege agent access limits each AI agent to the smallest set of tools, resources, parameters, credentials, data fields, and operating conditions required for its assigned purpose. Permissions should be checked during discovery and again at execution time.
Policy-Curated Tool Discovery
Returning only the tools allowed by an agent’s assigned policy.
Policy-curated tool discovery means filtering the available tool catalog before it is presented to an AI agent. In KeyRunner, a policy is a named group of approved tools. An onboarded agent receives only that group, which supports least privilege and can reduce tool-definition context sent to the LLM.
AI Tool Allowlisting
Explicitly permitting selected tools and denying all others.
AI tool allowlisting is a default-deny security model in which an agent may discover or invoke only tools explicitly permitted by policy. Hiding unauthorized tools reduces irrelevant model context, while a second runtime check prevents a caller from bypassing discovery and submitting a forbidden tool directly.
MCP Token Passthrough
Forwarding an inbound MCP access token to a downstream service.
MCP token passthrough occurs when a server forwards the token it received from an MCP client to a different downstream API. The MCP specification forbids this pattern because the token may have the wrong audience and can create a confused-deputy risk. Downstream access should use a separate, correctly scoped credential.
Agent Tool Server
A service that exposes callable tools to AI agents.
An agent tool server publishes named actions that an AI model or agent can discover and invoke. A governed agent tool server adds identity-aware tool filtering, per-call policy, credential isolation, approval gates, response controls, limits, and execution audit records.
Secretless Agent Execution
Allowing an agent to act without holding a reusable downstream secret.
Secretless agent execution is an architecture in which an AI agent requests a capability but never receives the reusable API key, password, or token used for the downstream action. A trusted identity broker or execution runtime obtains scoped access and performs or authorizes the request on the agent’s behalf.
Just-in-Time Access
Granting access only when needed and for a limited duration.
Just-in-time access grants a user, workload, or AI agent temporary permission when a valid request and policy condition are satisfied. The permission expires automatically, reducing the risk created by standing access and long-lived credentials.
Human Approval Gate
Pausing a high-impact agent action for an authorized human decision.
A human approval gate pauses an AI agent action before execution when policy identifies elevated risk. An authorized reviewer approves or denies the exact tool and parameters. Approved requests should expire quickly, and the request, reviewer, decision, and outcome should share one audit chain.
Agent Blast-Radius Scoring
Estimating the possible scope and impact of an agent action before execution.
Agent blast-radius scoring estimates how many systems, records, users, funds, environments, or downstream operations a proposed tool call could affect. The score can trigger tighter limits, human approval, or a policy block before the action runs.
Agent Tool Time Boxing
Limiting how long an agent action may run.
Agent tool time boxing sets a maximum execution duration for a tool call or workflow. When the limit is reached, the runtime cancels the operation and may trigger a defined rollback or recovery action, helping contain stalled calls and runaway workflows.
AI Agent Rate Limiting
Capping how frequently an agent may call a tool or API.
AI agent rate limiting restricts tool or API call frequency by agent, user, policy, tool, or time window. It helps control runaway loops, denial-of-service conditions, duplicate actions, downstream load, and unexpected model or API cost.
Agent Response Redaction
Removing restricted fields before API output reaches an AI model.
Agent response redaction removes, masks, tokenizes, or summarizes sensitive API response fields inside a trusted execution layer before the result enters model context. Rules may cover PII, PHI, payment data, secrets, internal identifiers, and organization-specific classifications.
AI Agent Audit Trail
A connected record of agent intent, policy, execution, and outcome.
An AI agent audit trail records the agent and requester identity, named tool, parameters, policy decision, approval, credential reference, response controls, downstream result, and timestamp. It connects agent intent to the resulting enterprise action without recording raw secrets.
AI Agent Observability
Visibility into agent decisions, tool calls, dependencies, and outcomes.
AI agent observability is the collection and analysis of traces, events, metrics, and logs across agent reasoning, tool selection, policy decisions, API calls, retries, data handling, and outcomes. Observability explains behavior, while governance controls whether an action is allowed.
Agent Goal Hijacking
Manipulating an agent into pursuing an attacker-controlled objective.
Agent goal hijacking is an attack in which malicious instructions or context redirect an AI agent away from its intended objective. External runtime policy reduces impact by preventing the compromised agent from discovering or executing tools outside its approved capabilities.
AI Agent Tool Misuse
Using a legitimate tool in an unsafe, unintended, or excessive way.
AI agent tool misuse occurs when an agent selects a valid tool but uses it with unsafe parameters, an inappropriate target, excessive frequency, or an unintended business purpose. Per-action policy, parameter validation, operating limits, and approval gates help contain the risk.
OpenAPI-to-Agent-Tool Conversion
Turning documented API operations into callable AI agent tools.
OpenAPI-to-agent-tool conversion transforms operations in an OpenAPI specification into named tools with descriptions and parameter schemas that an AI agent can call. A governed conversion process also binds each tool to agent policy, credentials, response rules, limits, and audit requirements.