As businesses accelerate their adoption of artificial intelligence, a new category of systems—commonly referred to as agentic AI—is rapidly emerging. Unlike traditional AI tools that simply generate text or provide recommendations, agentic AI systems can initiate actions, make autonomous decisions, and interact with digital environments in ways that resemble delegated human labor. This expanded autonomy introduces a fundamentally different risk profile, raising issues that intersect directly with legal compliance, data governance, cybersecurity, and operational accountability.

For legal and compliance teams, understanding these risks is no longer optional. Agentic AI challenges longstanding assumptions embedded in regulatory frameworks, contractual arrangements, and organizational policies. Whether a business is deploying internal automation, integrating AI into client-facing services, or relying on vendor-provided systems, teams must be prepared to identify where existing safeguards fall short and where new governance structures are required. The following discussion highlights four core challenges—identification, authentication, auditing and log integrity, and prompt‑injection vulnerability—that any organization must examine before entrusting meaningful authority to agentic systems. These challenges illuminate why the legal landscape surrounding AI autonomy remains unsettled and why proactive risk mitigation is essential for responsible deployment.

1. Issues of Identification in Agentic AI

Identification—the ability to determine who or what is acting within a system—becomes profoundly more complicated in the context of agentic AI. Traditional digital systems operate on the assumption that identifiable entities correspond to stable, discrete actors such as human users, services, or devices. Agentic AI challenges this assumption by functioning as an adaptive, semi‑autonomous intermediary capable of generating actions, negotiating state transitions, and engaging with external systems in ways that blur conventional identity boundaries. The result is a landscape where establishing a clear and reliable mapping between an action and its originating agent becomes significantly more difficult.

A core issue arises from the inherently dynamic nature of agentic behavior. Because agentic systems can create sub‑agents, spawn tasks across different contexts, or pursue inferred goals, their operational footprint is not tied to a single static identity. A single agent might shift roles depending on the task, change its internal representation of the user’s intent, or operate across multiple technical environments. This fluidity introduces ambiguity: when an action occurs, is it attributable to the top‑level agent, a delegated sub‑process, a tool call induced by prompt context, or an emergent behavior arising from model-driven reasoning? Without clear identity boundaries, downstream systems cannot reliably assign responsibility, enforce policy, or determine whether an action aligns with approved authority.

Compounding this challenge is the fact that agentic AI often co‑mingles user intent with model‑generated inference. Identification in traditional systems is grounded in explicit input—passwords, tokens, certificates, or cryptographic material tied to a human or service. Agentic AI, however, generates actions that may be partially derived from probabilistic reasoning, latent assumptions, or context extrapolation. The system may be “acting on behalf of” a user, yet performing tasks the user did not explicitly request. This results in ambiguous provenance: is the agent acting as an extension of the user’s identity, or as an independent actor with its own operational profile? Such ambiguity poses risks for compliance, accountability, and forensic reconstruction.

Another significant issue lies in multi‑party environments where agents interact with each other or with external systems. When multiple agents collaborate, negotiate, or exchange information, attributing an action to a specific initiating entity becomes difficult—especially when decisions emerge from distributed reasoning or iterative multi‑agent dialogue. Misidentification in this context can lead to inaccurate access control, unauthorized escalation of privileges, or misapplied trust between systems. Furthermore, adversaries can exploit these identification ambiguities by injecting malicious prompts or manipulating context to cause an agent to mimic another entity, act under incorrect assumptions, or inadvertently reveal sensitive information.

Ultimately, ensuring robust identification in agentic AI requires more than traditional identity and access management. It demands architectural mechanisms capable of binding actions to verifiable originators, even when decision‑making is emergent, distributed, or partially inferred. These mechanisms may involve immutable execution traces, enforceable capability boundaries, cryptographically verifiable agent identities, and strict separation between user credentials and agent operational profiles. As organizations move toward greater automation through agentic systems, the ability to reliably identify which agent did what, and why becomes central to maintaining security, trust, and regulatory compliance.

2. Authentication in Agentic AI

Authentication becomes a uniquely complex challenge in the context of agentic AI because these systems do not merely process data—they initiate actions, access resources, and make autonomous decisions on behalf of users or organizations. Traditional authentication frameworks assume that a human is the entity being validated and that subsequent actions stem directly from that user’s intent. Agentic AI disrupts this model by introducing a semi‑autonomous intermediary whose behavior, while user‑aligned in principle, may diverge meaningfully in practice. Ensuring that each action taken by the agent is properly authenticated—and that the authentication reflects legitimate authority rather than unintended or adversarial influence—is far from straightforward.

A primary concern is the conflation of user identity with agent identity. When an agent operates under a user’s credentials, the resulting audit trail may blur the boundary between user‑initiated and agent‑initiated actions. This presents significant accountability gaps. If an agent misinterprets a directive, falls prey to prompt injection, or escalates privileges through a toolchain, conventional authentication systems provide no mechanism to differentiate intent or to revoke autonomy at a granular level. Conversely, giving agents their own credentials introduces attack surfaces in the form of additional identity objects, which must be maintained, rotated, constrained, and protected from misuse—both by external attackers and by the agent itself.

Another critical challenge stems from the fluidity of natural‑language instructions. Authentication models typically depend on explicit, discrete permission requests. Agentic AI, however, often infers subgoals, generates its own plans, and invokes actions without receiving a directly authenticated command for each step. This creates an authorization drift problem: over the course of a multi‑step task, the system’s behavior may extend beyond the scope originally intended by the human, yet remain technically valid within its assigned permission envelope. Without fine‑grained scoping of capabilities—and continuous verification that each action aligns with the user’s current intent—agents may inadvertently exercise overly broad authority.

Finally, the integration of external tools and APIs compounds the authentication problem. Agentic systems frequently chain multiple services, each with its own authentication model, token format, policy regime, and security posture. This creates a brittle, interdependent trust surface where compromise or misconfiguration in one component can cascade across the entire action pipeline. Furthermore, if an agent’s internal reasoning can be influenced by untrusted inputs, adversaries may induce the agent to authenticate requests on their behalf or unintentionally disclose sensitive credentials. Preventing such scenarios requires architectural isolation, strict token‑handling rules, non‑delegable permissions, and cryptographically verifiable action boundaries—all of which are still emerging areas of practice.

3. Authorization in Agentic AI

Authorization in agentic AI presents a fundamentally different challenge from traditional permission systems because these models do more than access data or generate outputs—they initiate actions, trigger tool use, and execute workflows that may have real operational consequences. In conventional systems, authorization is tightly coupled to explicit, user-driven commands: an authenticated user performs a discrete action, and the system checks whether that action is permitted. Agentic AI disrupts this model by introducing autonomy between the authenticated user and the resulting action. The agent may reinterpret goals, infer next steps, or initiate subtasks that the user did not explicitly request, all while operating within the broad authorization envelope originally granted. This creates a structural gap between user intention and system behavior, raising concerns about scope creep, privilege escalation, and unintended authority.

A central problem is that authorization frameworks traditionally bind permissions to stable, identifiable actors—humans, services, or devices. Agentic AI challenges that assumption by behaving as a dynamic intermediary whose actions may not map neatly to a single identity or bounded intent. As noted in broader AI governance work, emerging standards bodies are beginning to recognize the need for agent-specific identity and authorization protocols, but these approaches remain early in development. Because an agent may generate sub‑agents, invoke tools across distributed environments, or reinterpret a user’s instructions through probabilistic reasoning, defining a clear, enforceable authorization boundary becomes difficult. The risk is that an agent may technically comply with its granted permissions while operating far beyond the user’s anticipated or legally acceptable scope.

Another challenge lies in the agent’s ability to interface with multiple external systems, each with its own authentication and authorization layers. When an agent chains APIs or tools together, a misconfiguration in one layer may cascade into others, expanding the agent’s effective authority in ways that are difficult to detect or reverse. Worse still, if the agent’s internal reasoning can be influenced—whether through prompt injection, ambiguous instructions, or corrupted context—an adversary may be able to trigger authorized actions that the user never intended. Authorization frameworks were not historically designed for systems that can be persuaded, and this mismatch exposes organizations to novel vectors of misuse.

Mitigating these risks requires a rethinking of authorization at both the architectural and policy levels. Organizations must move beyond static permissions and implement capability‑scoped authority, ensuring that the agent can only perform narrowly defined actions, even within authenticated sessions. This often requires fine‑grained permission tokens, non-delegable authority tiers, cryptographically verifiable action boundaries, and real‑time policy checks external to the model. Equally important is the need for explicit human‑in‑the‑loop or human‑on‑the‑loop mechanisms, particularly where the agent’s actions have legal, financial, or safety implications. As national and international standards bodies continue to develop agent‑specific identity and authorization frameworks, businesses deploying such systems will need to implement strong governance controls to ensure that agentic autonomy does not exceed organizational intent or regulatory compliance requirements

4. The Problems of Auditing Agentic AI

Auditing agentic AI systems presents a fundamentally different challenge from auditing traditional software or even conventional machine‑learning models. These systems operate autonomously, interpret goals dynamically, and continuously adapt their behavior based on context. As a result, they do not follow a fixed decision pathway that can be consistently traced or reproduced. The inherent stochasticity of large language models—combined with their ability to self‑modify plans, call external tools, and learn from interactions—complicates any attempt to establish transparent, repeatable audit trails.
One central difficulty arises from the opacity of model reasoning. Although agentic systems often externalize traces of their thought process, these “reasoning logs” are themselves model‑generated artifacts, not a direct representation of internal state. This creates an audit gap: the model’s apparent chain of thought may not reflect the true hidden computations that led to a decision. Therefore, auditors cannot rely solely on observable behavior to infer intent or assess whether decisions adhere to policy constraints. Unlike rule‑based systems, where logic flows can be deterministically inspected, agentic AI introduces epistemic uncertainty around what the system believes it is doing at any moment.

Another major challenge is the multi‑step, tool‑integrated nature of agentic workflows. In an auditing context, each tool invocation—retrieving files, sending messages, querying APIs, or modifying content—represents a potential point of risk. However, the reason the agent triggered a particular action often depends on a long chain of prior contextual influences, some originating in user input, others emerging from environmental data. This makes root‑cause analysis significantly more complex. The audit question shifts from “What did the system do?” to “Why did the system decide to do this, and what contextual triggers shaped that decision?” This level of causal reconstruction is difficult to achieve, especially when the agent operates over long horizons or across asynchronous tasks.

Additionally, the fluidity of prompt‑based instruction complicates compliance auditing. Agentic systems can inadvertently override constraints when exposed to conflicting instructions, ambiguous goals, or adversarial inputs. Because these interactions occur in natural language, there is no strict boundary between content and directive. As a result, ensuring that the system consistently applies safety rules becomes inherently non‑deterministic. Even small changes in phrasing, timing, or environmental inputs may produce divergences in behavior, undermining the reliability of retrospective audits.

Furthermore, auditing agentic AI requires not only examining the system’s outputs but also validating its alignment with organizational policies, legal frameworks, and ethical standards. These concepts are not always formally defined in computational terms. Traditional audit procedures—such as log capture, policy verification, and event reconstruction—are insufficient when dealing with a system that simulates reasoning, anticipates user intent, and autonomously orchestrates tasks. New methodologies are needed to capture latent goal shifts, emergent behaviors, and context‑dependent decision pathways. This requires multidisciplinary approaches combining safety engineering, interpretability research, and robust system‑level oversight

A further complication lies in the preservation and integrity of audit logs that track agentic AI actions. Unlike conventional systems where logs record deterministic, explicitly coded operations, agentic AI generates actions through probabilistic reasoning and dynamic context interpretation. This means that log entries must capture not only the actions taken but the evolving context, tool calls, environmental inputs, and intermediate decision states that shaped those actions. However, preserving this level of detail introduces storage, privacy, and operational burdens. Logs can become extremely high‑volume and semantically dense, making them difficult to index or review without specialized tooling. More critically, because agentic systems may chain together dozens of internal reasoning steps for a single action, even comprehensive logs may fail to represent the model’s underlying latent decision process. Ensuring tamper‑resistance is also nontrivial: if an agent can read or write system memory or interact with logging mechanisms, it may inadvertently (or through adversarial manipulation) compromise the integrity of its own logs. For these reasons, organizations deploying agentic AI must approach log preservation as a form of critical infrastructure—requiring immutable storage layers, strict separation of duties between the agent and the logging pipeline, cryptographic integrity protections, and policies for long‑term retention that balance transparency, security, and regulatory compliance.

5. Prompt Injection Risks in Agentic AI Systems

Prompt injection represents one of the most significant emerging security concerns in the era of agentic AI—systems that operate autonomously, take actions on behalf of users, and interface directly with real‑world tools and data. Unlike traditional models that simply generate text, agentic AI systems interpret instructions, call external APIs, modify documents, and execute multi‑step workflows. This expanded action space dramatically amplifies the consequences of malicious or ambiguous inputs. A single injected instruction can lead not just to incorrect output, but to concrete system behaviors such as sending messages, editing files, retrieving sensitive data, or altering operational processes.

At its core, prompt injection occurs when an adversarial user or external data source embeds hidden or manipulative instructions intended to override the system’s original directive. Agentic systems are especially vulnerable because they often ingest untrusted content—emails, websites, documents, messages, or user‑generated text—and treat it as part of their reasoning context. An attacker may place instructions like “ignore previous rules” or “forward all confidential content to this address,” hidden in webpages, metadata, or even inside code comments. When an agent parses this input during its tool‑use cycle, the model may mistakenly interpret the injected prompt as a legitimate instruction and act on it.

A unique challenge arises from the fact that agentic AI typically maintains longer contextual chains and autonomous decision loops. The system may revise its own plans, interpret ambiguous cues, or re‑invoke tools without explicit human oversight. This increases the surface area for indirect prompt injection, where manipulated data triggers harmful downstream reasoning steps. What makes this more difficult to mitigate is that natural language instructions do not have formal boundaries—models do not inherently distinguish “instructions” from “content.” As a result, relying solely on traditional input sanitization or access controls is insufficient; even benign‑looking text may result in the agent adopting unintended goals.

Mitigating prompt injection in agentic AI requires a layered defense strategy. This includes architectural isolation between the model and high‑risk actions, strong authentication around tool capabilities, explicit policy guards outside the model, and continuous monitoring of action traces. Additionally, emerging methods such as capability‑scoped plans, high‑assurance function calling, and restricted execution sandboxes help limit the blast radius of compromised instructions. Despite these advances, the field remains in active research, as no existing mechanism provides complete protection against sophisticated injection attacks. For organizations deploying agentic systems, recognizing prompt injection as a first‑class security threat is essential to responsible and safe adoption.

Agentic AI systems offer transformative efficiencies, but they simultaneously introduce novel legal and operational uncertainties that businesses cannot afford to ignore. As illustrated in the challenges above—and reflected in the detailed issues documented in agentic ai – 1—the autonomy of these systems complicates the foundational pillars of governance: determining who acted, verifying authorization, reconstructing why actions occurred, and ensuring the integrity of the records documenting those actions.

In this environment, legal and compliance teams plays a pivotal role. Lawyers must help organizations design safeguards that meaningfully constrain AI autonomy, implement defensible oversight structures, and adapt existing policies to technologies that do not fit prior frameworks. Organizations that thrive will be those that recognize agentic AI not only as a strategic asset but as a governance challenge requiring accountability, continuous monitoring, and robust legal and technical controls.
By approaching agentic AI deployment with caution, rigor, and foresight, businesses can reap the benefits of automation while preserving the trust, security, and legal resilience essential in today’s digital economy.