# SP-047 Secure Agentic AI Frameworks

Status: active. Release 2.0. Modified 2026-03-09. Licence: CC BY-SA 4.0.

Scope: Enterprise security architecture for adopting agentic AI frameworks (LangChain, CrewAI, AutoGen, LangGraph, and similar orchestration platforms) safely at scale. Covers agent execution isolation, tool registry governance, guardrails architecture, RAG pipeline security, multi-agent communication trust, cost and resource governance, agent lifecycle management, and incident response for autonomous agent failures.
Use when: The organisation is evaluating or deploying agentic AI frameworks (LangChain, LangGraph, CrewAI, AutoGen, Semantic Kernel, Bedrock Agents) for production use cases. AI agents will have access to enterprise tools, APIs, databases, or code execution environments.
Not when: Organisation uses AI only for simple prompt-response interactions with no tool access, no autonomous actions, and no multi-step workflows -- SP-027 alone provides sufficient coverage.

## Controls (35, NIST SP 800-53 ids)
- Critical (12): AC-03, AC-04, AC-05, AC-06, AU-02, AU-03, CA-07, CM-07, IR-04, SA-09, SC-07, SI-10
- Important (23): AU-06, CM-02, CM-03, CM-04, CM-08, IA-04, IA-05, IA-08, IR-01, IR-06, PM-09, RA-03, RA-05, SA-04, SA-08, SA-11, SC-04, SC-08, SC-28, SC-39, SI-04, SR-02, SR-03

## What each critical control mitigates (12)
- AC-03 Access Enforcement: T-AAF-002, T-AAF-012, T-AAF-014, T-AAF-016
- AC-04 Information Flow Enforcement: T-AAF-001, T-AAF-003, T-AAF-004, T-AAF-009
- AC-05 Separation of Duties: T-AAF-003, T-AAF-006
- AC-06 Least Privilege: T-AAF-005, T-AAF-007
- AU-02 Event Logging: T-AAF-005, T-AAF-007, T-AAF-010, T-AAF-014, T-AAF-016
- AU-03 Content of Audit Records: T-AAF-003, T-AAF-006
- CA-07 Continuous Monitoring: T-AAF-006, T-AAF-007, T-AAF-011
- CM-07 Least Functionality: T-AAF-009, T-AAF-012
- IR-04 Incident Handling: none of the threats below
- SA-09 External System Services: T-AAF-015
- SC-07 Boundary Protection: T-AAF-001, T-AAF-009, T-AAF-011, T-AAF-015
- SI-10 Information Input Validation: T-AAF-001, T-AAF-002, T-AAF-004, T-AAF-006, T-AAF-011, T-AAF-013, T-AAF-015

## Threats and the controls that mitigate them (16)
- T-AAF-001 Agent goal hijack through adversarial prompt injection in tool outputs or retrieved documents: SI-10, SC-07, AC-04, CM-02
- T-AAF-002 Tool misuse — agent tricked into invoking wrong tool or passing malicious parameters via prompt manipulation: AC-03, CM-08, SI-10, SA-11
- T-AAF-003 Cross-agent context poisoning in multi-agent systems — compromised agent contaminating shared state: AC-04, AC-05, IA-04, AU-03
- T-AAF-004 RAG retrieval poisoning — malicious content injected into vector stores to manipulate agent responses: SI-10, SC-28, CM-08, AC-04
- T-AAF-005 Agent credential theft through tool interactions or context window exposure: IA-05, SC-28, AC-06, AU-02
- T-AAF-006 Cascading hallucination — incorrect output from one agent propagating unchecked through multi-agent pipeline: SI-10, AC-05, AU-03, CA-07
- T-AAF-007 Runaway agent resource consumption — uncontrolled loops or recursive agent spawning exhausting compute and API budgets: AC-06, CA-07, AU-02, PM-09
- T-AAF-008 Framework supply chain compromise — vulnerabilities in agentic framework dependencies or malicious packages: SR-02, SR-03, SA-04, RA-05
- T-AAF-009 Unauthorised external access — agent making network calls, API requests, or data exfiltration outside approved endpoints: SC-07, CM-07, AC-04, SI-04
- T-AAF-010 Agent state and memory manipulation — corrupting checkpoints, memory stores, or configuration to alter future behaviour: SC-28, SC-04, CM-02, AU-02
- T-AAF-011 Guardrail bypass through indirect channels — circumventing safety controls via encoded instructions, multi-step reasoning, or tool-mediated payloads: SI-10, SC-07, SA-11, CA-07
- T-AAF-012 Shadow agent deployment — unauthorised agentic workflows running outside the governed platform: CM-08, CM-07, SI-04, AC-03
- T-AAF-013 MCP tool poisoning — malicious logic hidden in tool descriptions, schemas, or metadata that models interpret without human visibility: CM-08, SA-04, SI-10, SA-11
- T-AAF-014 MCP confused deputy — proxy servers reusing credentials without verifying requestor authorisation, enabling cross-user access violations: AC-03, IA-05, IA-08, AU-02
- T-AAF-015 MCP server-side request forgery — malicious servers directing OAuth discovery or callbacks to internal resources or cloud metadata endpoints: SC-07, SC-08, SI-10, SA-09
- T-AAF-016 MCP token passthrough — servers accepting tokens not issued for them, bypassing security controls and accountability: IA-05, IA-08, AC-03, AU-02

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-047/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-047/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 54 KB: /api/v1/patterns/SP-047
- Page for people: /patterns/sp-047/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-027 Secure LLM Usage; SP-045 AI Governance and Responsible AI; SP-030 API Security; SP-029 Zero Trust Architecture; SP-012 Secure Software Development Lifecycle; SP-031 Security Monitoring and Response; SP-037 Privileged User Management

This card, the API and the page are generated from one file. Checking one against another adds no evidence.