Analysis
AI agent risk frameworks: is the rule of two already broken?
Publication date not yet evaluated · Added nhimg.org
Page published
Coverage timeline
Single-source analysis — one report is available.
Why it matters
The 'Rule of Two' framework offers false assurance for agentic deployments, so defenders need to reassess how combined capability, autonomy, and privilege at runtime creates compounding risk paths.
An NHIMG editorial, based on Noma Security's analysis, argues that the 'Rule of Two' agent risk framework breaks down in real deployments because two-of-three conditions (capability, autonomy, privilege) can still yield destructive outcomes such as prompt injection in developer tools or autonomous agents deleting production data. It proposes governing AI agents as non-human identities with scoped privileges, discoverability, and action-level auditing.