Agentic Security: The Governance Gap Regulation Is Only Now Catching Up To
Published — Agentic Security
The topic, not just the project
Agentic security as a real engineering discipline is younger than the agents it’s meant to govern. OWASP published the first formal taxonomy of agent-specific risk — the Agentic AI Security Top 10 — in December 2025: goal hijacking, tool misuse, prompt injection, cascading failures, identity abuse. Microsoft open-sourced an Agent Governance Toolkit in April 2026 mapping those risks to capability sandboxing and semantic intent classification. Both are real, serious efforts, and both arrived after agentic systems were already running in production with autonomy levels nobody had a clean way to audit.
Why most of it still doesn’t catch the thing that matters
The dominant approach — watch a sequence of agent actions for a suspicious pattern — has a structural weakness: it needs memory to work, and memory is itself a new attack surface. An attacker (or just an unlucky race condition) who inserts a pause between steps can defeat a sequence monitor without ever producing an individually-flagged action. Four actions that are each fine in isolation — create a resource, make it public, copy sensitive data in, export it — only look dangerous assembled, and a monitor that isn’t watching the right window misses it entirely.
Anubis, NARVI’s own agentic-security product, commits to a different real trade: never track a session at all. Judge the state a proposed action would produce, not the sequence that led to it. The same four-step exfiltration dies at step three — not because Anubis remembers steps one and two, but because “an internal-DB-tagged resource in a publicly-exposed path” is a hard violation the instant it would exist, independent of path. That’s a narrower claim than “we watch your agents,” and a more defensible one — stateless, fast, and auditable in a way a session graph structurally can’t be.
The regulatory floor is rising under all of this
The EU AI Act’s human-oversight and auditability requirements for high-risk AI systems take enforcement effect in August 2026 — not a future deadline anymore, a current one. Combined with real incidents already on record (the Alibaba-affiliated crypto-mining agent is one of several), the honest read is that agentic security isn’t a speculative category anymore. The open question the field hasn’t resolved: delta-based, stateless approaches like Anubis’s don’t catch a violation that never produces one bad snapshot — data moved through a series of equally-restricted locations before a final authorized export, for instance. That’s a real, named gap, not a solved one.
Sources: GitHub — awesome-ai-agent-governance, BigID — What Are Agentic AI Guardrails?, Dataiku — AI Agent Governance Guide