MHC-13 AI agent governance and harness security

At a glance

Operational benefit

brings production AI agents and agentic workflows under control — self-developed as well as SaaS, low-code and no-code agents: limited access, complete traceability, human approval before risky actions — and thereby closes an otherwise uncontrolled attack surface.

Policy affected

a new policy on the use of AI agents; additionally the access control and procurement policies.

Dependencies

presupposes the identity basis from MHC-04; touches MHC-09 (insecure AI code) and the shadow AI inventory (A.5.9).

Effort drivers

depends on the number and reach of the agents and connections deployed; later build-out stages presuppose suitable tools available in the organization's own environment. The actual effort depends on the organization's resources.

Primary metric

share of production agents with a documented threat model and limited access, together with the coverage of logging.

Standards touched (no claim of fulfilment)

among others ISO/IEC 42001 Annex A, NIST AI RMF 1.0, OWASP threat taxonomies; depending on the field of use, also the EU AI Act.

Control statement

Production AI agents and agentic workflows — self-developed as well as SaaS, low-code and no-code agents — are treated like privileged systems: a limited blast radius per agent, an identity limited to the necessary entitlements, complete and traceable logging with a named human owner and a kill switch, and an allow list for agentic components (MCP servers, IDE extensions, skills, connectors).

Minimum requirements for self-developed or self-controlled agents: a technical, capability-scoped identity instead of personal user accounts or blanket API keys; expressly no unrestricted tool access; tamper-resistant, verifiable execution logging — the log is security-relevant evidence and is connected to the central, tamper-resistant logging from A.8.15 (MHC-05); documented purpose limitation and an approved tool scope per function; defined approval thresholds for actions with a high damage impact. The identity basis is supplied by MHC-04 (workload identity), on which the capability-scoped limitation builds. Advanced hardening (Managed level): code review for the harness components under the organization's own control.

Minimum requirements for SaaS, low-code, no-code and externally operated agents: an agent-specific identity so far as the platform supports it, otherwise dedicated service accounts with least-privilege delegation; admin consent and permission control at platform level; allow-listing of connectors and extensions; documented permission boundaries; activation and regular evaluation of the platform-side logging, with export where available; vendor assessment and contractual assurances (vendor assurance); configuration controls against unintended privilege escalation. Harness code review applies here only to components under the organization's own control (for example its own connectors, scripts or prompt and flow definitions).

Purpose and threat relevance

AI agents combine the reasoning of a language model with tool execution, persistent memory and multi-stage planning. This creates a privileged attack surface outside the established security measures (Mythos-Ready, CSA/SANS/OWASP, April 2026: "Unmanaged AI Agent Attack Surface", classified CRITICAL). Two risk sides: first, over-privileged or insecure agents in the organization's own operations; second, the supply chain — compromised MCP servers, IDE extensions or skills. Evidenced by real incidents: EchoLeak (CVE-2025-32711, unnoticed data exfiltration through prompt injection in Microsoft 365 Copilot) and CurXecute (CVE-2025-54135/-54136, code execution through the MCP integration of the coding IDE Cursor).

Effect across frameworks

These are the controls and requirements the MHC acts on. The classification shows how much each control loses its effect under AI-enabled attacks.

All 93 controls in the analysis matrix · All 45 controls in the findings matrix · All 23 requirements of the module family

Maturity path

Initial

production AI agents and agentic workflows are inventoried — including SaaS, low-code and no-code agents; a manual inventory of the MCP servers and extensions.

Defined

limited identities and complete logging in production; a named human owner and a tested kill switch per agent; a threat model per purpose of use; an allow list for extensions, connectors and MCP servers.

Managed

a full code review process for the harness components under the organization's own control; automated checks before production deployment; mean time to revoke below 5 minutes; regular penetration tests against prompt injection.

Realism

most organizations start at Initial; realistically 12 to 18 months to Defined, 18 to 24 months to Managed. Prioritize first: inventory, logging and limited identities — these three address the bulk of the risk. Penetration testing of the harness and checks of model robustness follow in later build-out stages, depending on the tools available in the organization's own environment.

Measurement and audit evidence

Metrics

share of production AI agents and agentic workflows within the organization's area of responsibility — including SaaS, low-code and no-code agents — with a documented threat model and a defined blast radius (target: 100%); collected separately as inventory coverage (fully inventoried) and governance coverage (owner, identity, permission boundaries and tamper-resistant log implemented); coverage of logging for actions with write or network rights (target: 100%); time to revocation of compromised agent identities (target: below 5 minutes).

Evidence

agent inventory, allow list configuration, logs, pre-production test reports, threat model documents.

Evidence logic (following ISO/IEC 27001, Clause 9)

documented? — through the inventory and threat models; responsible? — a named human per agent; frequency? — continuous logging, a check before every production deployment; tolerance? — no production agents with write or network rights without logging.

Typical mistakes

• Agents run under personal developer accounts — no limited identity, no clean traceability.
• MCP servers and extensions without an allow list and without update control — automatic updates open a path through the supply chain.
• The harness (instructions, rule files) is treated as configuration rather than as code — no approval, no version control.
• Human approval in name only (a confirmation dialogue without a genuine opportunity to check) — the excessive freedom of action remains.
• The target "Managed" is set across the board even though the tools and procedures needed for it are not yet established in the organization's own environment.

Delimitation and residual risk

Delimitation

covers the governance and security of production AI agents and agentic workflows within the organization's area of responsibility — self-developed as well as SaaS, low-code and no-code agents; the identity basis is supplied by MHC-04; insecure AI-generated code is dealt with in MHC-09; the inventory of unapproved AI tools (shadow AI) is set out in A.5.9 (MRIS extension).

Residual risk

prompt injection is not fully solvable as long as the instruction and data channels cannot be separated; detection is not prevention; suitable hardening tools are not available in every environment.

ISO/IEC 27002:2022

A.5.9 Inventory of information and other associated assets; A.5.16 Identity management; A.8.27 Secure system architecture and engineering principles.

AI-specific

ISO/IEC 42001:2023, Annex A (AI management controls via the Statement of Applicability); NIST AI RMF 1.0; NIST AI 100-2e2025 (adversarial machine learning).

Threat models

OWASP Top 10 for LLM Applications 2026 (LLM01 prompt injection; LLM03 excessive agency — with the causes excessive functionality, excessive permissions, excessive autonomy; LLM04 supply chain); OWASP Top 10 for Agentic Applications (ASI01 agent goal hijack, ASI02 tool misuse, ASI03 identity and privilege abuse); OWASP "Agentic AI — Threats and Mitigations"; OWASP "Practical Guide for Securely Using Third-Party MCP Servers"; MITRE ATLAS (AML.T0051 LLM prompt injection, AML.T0053 AI Agent Tool Invocation (formerly LLM Plugin Compromise; ATLAS status August 2026), AML.T0086 exfiltration via AI agent tool invocation, AML.T0110 AI agent tool poisoning).

Implementation in detail

Organizational and technical implementation, implementation examples and the prioritization within the overall programme are described in the Implementation Guide.

Implementation Guide (PDF)Back to the MHC catalog

Source: MRIS Implementation Guide (ISO/IEC 27001), edition 2.0. License CC BY-SA 4.0. © 2026 Richard Peddi.