Agentic AI: proposal is not permission

Core thesis

Agentic AI changes the execution question.

A model output may be only a proposal.

A tool call may become an action.

An agent-to-agent message may redirect authority.

A human approval may convert a recommendation into institutional consequence.

The OWASP Top 10 for Agentic Applications 2026 provides a useful public vocabulary for agentic AI security risks, including goal hijack, tool misuse, identity and privilege abuse, memory/context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents.

Arqua does not replace security engineering, AI governance, model risk management or operational controls. Arqua adds the execution-admissibility lens: before an AI-influenced action binds consequence, the organisation must be able to determine whether execution is admissible now, under current authority, evidence, context, constraints and state.

Bridge logic

OWASP-style agentic concern	Arqua execution-admissibility question
Agent goal hijack	Has the agent’s proposed action drifted from the authorised purpose before execution?
Tool misuse	Is the tool call permitted for this actor, purpose, context and consequence class?
Identity and privilege abuse	Is authority being re-resolved at execution, or inherited from an earlier session, user, agent or workflow state?
Memory and context poisoning	Is the evidence basis current, trusted and fit for execution?
Insecure inter-agent communication	Can the organisation prove the provenance, integrity and authority of the message that influenced execution?
Cascading failures	What prevents one faulty AI-influenced action from propagating through downstream workflows?
Human-agent trust exploitation	Is human approval acting as genuine authority, or merely laundering an AI recommendation into execution?
Rogue agents	What detects, contains or refuses execution when agent behaviour deviates from its authorised scope?

Boundary note

This page is an architectural bridge note. It does not assert OWASP certification, endorsement, partnership, affiliation, legal assurance, regulatory compliance, security assurance, system operation or implementation. Arqua operates at the architecture and governance layer. Runtime behaviour, security engineering, implementation, regulatory compliance and operational responsibility remain with the deploying organisation and its chosen delivery partners.

Source basis

OWASP Top 10 for Agentic Applications 2026, OWASP Gen AI Security Project — Agentic Security Initiative.

Document Status: Public Website Page

Publication Date: 2026

Version: 1.0

Last Updated: 23 July 2026

Owner: Arqua Pty Ltd

Author: Mark Tovey

Portfolio: Enterprise Intelligence Architecture

This publication forms part of the Arqua Enterprise Intelligence Architecture portfolio.

No part of this publication may be reproduced, redistributed, adapted, republished or incorporated into derivative works without the prior written permission of Arqua Pty Ltd, except for brief quotations used with appropriate attribution.

The concepts, architectural models, constitutional frameworks, terminology and diagrams presented on this page constitute original intellectual property developed by Arqua Pty Ltd.

Publication of this material does not grant any licence to implement, commercialise or reproduce the underlying intellectual property.

Arqua®, SCIA™, Enterprise Intelligence Architecture™, Runtime Context Assembly™, Enterprise Representation Intelligence™, Institutional Memory™, Execution Admissibility™, Pre-Execution Pressure Test™, Authority Pressure Test™, and associated architectural terminology may be trademarks, registered trademarks or protected intellectual property of Arqua Pty Ltd.