For twenty years, human risk management sat at the center of the enterprise security model. The employee was the decision point: they clicked or they didn’t, they typed the wrong data into the wrong window or they caught themselves in time, they fell for the phish or they reported it. Every control in the stack — training, awareness campaigns, behavior scoring, nudges — existed to shape that one moment of human judgment. The human was, in a very literal sense, the control plane.
Agentic AI didn’t remove the human from that picture. It moved the picture.
What “control plane” actually means here
In networking, the control plane is the layer that decides — it sets the routes, enforces the policy, and tells the data plane what it’s allowed to do. The data plane just executes. When people talk about security models being “human-centered,” what they really mean is that the human was the control plane: the point where intent got translated into permission, and where an attacker’s only real lever was persuasion.
Autonomous agents change what needs deciding. An agent doesn’t get phished in the way a person does, but it inherits every permission it’s been granted, reasons in natural language about ambiguous instructions, and executes multi-step actions without a human in the loop to catch a bad call before it lands. The attack surface stops being “can I trick this specific person” and becomes “can I get content into this agent’s context that it will treat as an instruction.” That’s a different kind of vulnerability, and it needs a different kind of governance — one that lives upstream of the moment any single action gets taken.
That’s the shift the infographic is pointing at. Human risk didn’t leave the diagram. It moved from being the thing security teams manage directly to being one signal that feeds a control plane built around identity, context, inference, MCP, and runtime enforcement.
The evidence this isn’t theoretical
This isn’t a speculative framework. The data from 2026 backs it up, and it backs it up in a way that’s uncomfortably concrete.
OWASP’s 2026 State of Agentic AI Security and Governance report reads differently from its 2025 predecessor for one simple reason: last year it catalogued plausible threats, and this year it’s cataloguing CVEs, vendor advisories, and actual breach reports. A backdoored version of LiteLLM — the gateway that a huge share of agent frameworks route through — sat live on PyPI for three hours in March 2026 and picked up roughly 47,000 downloads before it was pulled. The attacker chain that got it there didn’t involve tricking a person into clicking a link. It involved a compromised CI token, a poisoned build pipeline, and an autonomous exploitation bot that needed no further human direction once it launched.
Separately, disclosed CVEs against major coding agents in 2026 have shown that allowlisting — the most common form of “human sets the rules” governance — can be turned against itself. When an agent’s execution environment gets poisoned, an allowlisted command can be made to deliver an entirely different payload than the one the human approved. The control was aimed at the wrong layer.
The identity numbers are the starkest part of the picture. Recent industry research on agentic breaches found that the majority of incidents trace back to over-permissioned credentials — agents holding more standing access than their task required — with prompt injection landing on roughly one in three deployed agents. That’s not a training problem. No amount of “human risk awareness” fixes an agent that was simply handed too much access and then hijacked through content it was asked to process.
Why the industry is converging on the same five-layer answer
What’s notable is that security researchers, vendors, and standards bodies arrived at almost the same taxonomy independently, and it maps closely onto the infographic’s five nodes:
Identity. The Coalition for Secure AI’s Agentic IAM paper, approved this spring, formalizes agents as verifiable, auditable principals — not service accounts riding on human credentials, but their own identity class with lifecycle management and short-lived, scoped, cryptographically verified tokens. The instinct is the same one driving Auth0’s and Okta’s new MCP-specific identity products: an agent needs to prove who it is at every hop, not just at login.
Context. What an agent is allowed to see has to be scoped the same way access has always been scoped for humans — least privilege, but applied to retrieval, memory, and the documents an agent is permitted to load into its own reasoning.
Inference. This is the layer that’s genuinely new. A model reasoning over untrusted content is, structurally, reasoning over instructions it can’t fully distinguish from data. Prompt-level rules like “never run a destructive command” aren’t controls; researchers now describe them plainly as suggestions to a stochastic system, because a sufficiently well-crafted input can override them. That’s exactly why enforcement has to sit outside the model rather than inside the prompt.
MCP. The protocol Anthropic introduced in late 2024 became, by 2026, the common substrate nearly every agent runtime speaks — Claude Code, Codex CLI, Cursor, Gemini CLI, and the rest. That ubiquity is exactly why it’s also the layer researchers keep flagging for missing or improper access control: a shared standard is only as safe as its weakest implementation, and object-level authorization at the tool-call level is still catching up to adoption.
Runtime enforcement. The newest category, and the one with the least available tooling a year ago. Deterministic, sub-millisecond policy checks on live tool calls, with a defined fail-closed path — revert to human approval, or halt execution — for anything above a risk threshold. Microsoft’s Agent Governance Toolkit and the emergence of dedicated runtime governance vendors this year are both direct responses to the same realization: functional testing doesn’t catch a hijacked agent, because a hijacked agent completes its run successfully. You only catch it by inspecting what it actually did.
What this means if you’re building or buying
Two things follow from this, and they’re the two things worth taking away.
First, human risk management doesn’t get to retire. It becomes one input feed among several — alongside data sensitivity, tool permissions, session state, and policy — into a control plane that governs what the agent can see, call, and do. Treat it as obsolete and you’ll under-invest in the layer that still explains a meaningful share of incidents: humans over-provisioning agents in the first place.
Second, and more urgently: you can nudge a human. Training works, however imperfectly, because a person can be reasoned with, reminded, and held accountable after the fact. A bot doesn’t respond to a reminder email. It responds to what it’s structurally capable of doing in the moment an instruction — legitimate or injected — reaches it. That’s why the center of gravity in security spend and standards work has moved to constraint: scoped identity, sandboxed tools, and enforcement that fails closed rather than fails open.
The control plane moved because the thing making the decisions moved. Security has to follow it there.