Security and governance in agentic systems are architectural problems. They cannot be added as features after the fact. The risks are specific to systems where agents have tools, permissions, and real-world reach. Governance organises how those risks are addressed at the level of an organisation rather than an individual session.

Prompt injection is the foundational security risk: malicious content in the agent’s environment embeds instructions that the agent treats as commands rather than data. The agent has no mechanism for distinguishing instruction from content. Both are text in the context window.

Blast radius is the organising concept for permission design. An agent with broad permissions can cause damage at the scale of those permissions if compromised. The engineering response is minimal footprint. Malicious tool servers and supply-chain attacks on the agent’s tool dependencies are the infrastructure-level equivalent of prompt injection. The OWASP Top 10 for Agentic Applications is the practical reference.

Governance complements security as the organisation-level concern. Where security asks what an attacker could do, governance asks what the organisation has sanctioned: who is allowed to authorise which agent actions; what policies the agent must follow before acting; what records of agent activity must persist and for how long; what human review is required before specific classes of work are accepted. AgentOps names this work as a discipline rather than a side concern. Governance is the structural continuation of the audit-trail commitment introduced in Module 4.