Clarion Street

Certifying the Loop: Access Control and Audit in Agentic Workflows

·8 min read

In an earlier post I argued that point-in-time audit regimes cannot certify agentic software, because a system that decides its own tool calls at runtime has no fixed “supposed to do” to check against. I still think that is right, but it is vague in a way that has been nagging me. “Agents are unpredictable” lets a reader nod and move on. I want to name the specific thing that breaks and the specific control it breaks first.

The thing is the loop. An agent is not a pipeline. It is a for-loop with a language model in the middle of it, and the loop’s control flow is decided at runtime by the model. That is what a fixed, enumerable control catalog cannot certify. And the two control families where the collision shows up first are not exotic. They are Access Control and Audit and Accountability, two of the most basic families in NIST SP 800-171.

The loop is the unit

LangGraph, the low-level orchestration library behind LangChain, exists to add cycles where LangChain’s earlier chains had none. Those chains were directed acyclic graphs. There was no way to loop back. LangGraph adds cyclical graphs, and the team’s own description is the clearest statement of the problem: an agent “can essentially be thought of as running an LLM in a for-loop,” where “cycles often use the LLM to reason about what to do next in the cycle.”

The canonical loop is two steps. Call the model to decide an action or a response. Take the action. Feed the result back. Repeat until there is a final answer. In LangGraph’s StateGraph this is a mutable central state that nodes update, with conditional edges where “a function (often powered by an LLM)” chooses which node runs next. The only guarantee that the loop terminates is the developer’s, and the LangChain team’s warning is literal: “It is important that your cycles be able to end eventually!”

That warning is the whole problem in one sentence. A compliance regime wants to know, in advance, every state a system can be in and every transition between states, so it can attach a control to each one and check it on a schedule. A loop whose next branch is chosen by the model has a transition set that is not enumerable in advance. You cannot attach a control to a branch you cannot name.

The control catalog is fixed and point-in-time

CMMC is the cleanest version of the regime the loop breaks. It verifies that defense contractors meet NIST SP 800-171, Rev 3 plus a subset of SP 800-172, across three levels. Each level is a fixed count of practices and assessment objectives. Level 1 is 14 practices and 59 objectives, assessed annually by self-assessment. Level 2 is 110 practices and 320 objectives, assessed every three years by a third party. Level 3 is 110-plus practices and 320-plus objectives, assessed every three years by the government.

Assessment evidence is produced against each objective through NIST SP 800-171A, the companion assessment guide. That is a fixed, enumerable control set, checked on a cadence, with a specific artifact produced per requirement. Point-in-time, evidence-based assessment. It works fine for software whose behavior can be enumerated in advance.

SP 800-171 organizes its controls into families. Two of them sit exactly where an agent loop collides with the framework: Access Control and Audit and Accountability. Access Control presumes a static, human-administered authorization posture, least privilege over a known set of actors and functions. Audit and Accountability presumes a discrete set of security-relevant events you can decide to log.

An agent loop breaks both at once. Every iteration is a fresh authorization decision, because the model selects which tool to invoke based on the prior output. And the events worth logging are whatever the loop happened to do, which is not a list you can write down in advance.

Excessive Agency names the access-control half

The security community has named this. The OWASP GenAI LLM Top 10, in its 2026 edition published August 4, ranks Excessive Agency at number three. OWASP defines it as the vulnerability that enables damaging actions in response to unexpected, ambiguous, or manipulated LLM output, with three root causes: excessive functionality, excessive permissions, excessive autonomy.

The mechanism OWASP describes is the loop itself. Agent-based systems make repeated calls to a model using output from previous invocations, and the model selects which tool to invoke dynamically. That is not a coincidence. Excessive Agency is what you get when the loop I described above is allowed to reach tools with more permission than the task needs.

The mitigation is the interesting part. OWASP calls for “complete mediation”: implement authorization in logic rather than relying on the LLM to decide if an action is allowed. And in delegated or multi-agent workflows, preserve the original user’s context and authorization scope across chained tool or agent calls. That is a demand that the authorization decision sit outside the loop, in a policy decision point, and that the loop carry the original caller’s scope rather than granting its own.

The vendors are converging on the same fix

Both of the major agent runtimes are heading toward the same answer, and it is worth being blunt about what their claims are and are not.

CrewAI, now positioning itself as “The Enterprise Agent Build & Runtime” and claiming use by “65% of the Fortune 500,” sells a Control Plane that, in its words, “sits in the execution path of every workflow.” Its pitch is RBAC and audit for granular control, immutable audit trails, Enterprise IAM, human-in-the-loop approval gates, runtime hooks that inject PII redaction and policy checks at every LLM and tool call, and “deterministic agent workflows.”

LangGraph advertises durable execution, agents that persist through failures and resume from where they left off, human-in-the-loop interrupts, and LangSmith tracing as the observable backbone.

This is where the prior post and this one converge on the same caveat. Those CrewAI claims come from a sales page. None of them is mapped to a control framework or accepted by an assessor as evidence that a control exists. “Immutable audit trails” is a product feature, not a completed SP 800-171A assessment objective. The gap is being closed by product, not by regulation, and a product feature is not a certification.

The audit artifact becomes the trace

If the loop’s branches are not enumerable in advance, the audit evidence cannot be a point-in-time artifact. It has to be the trace of what the loop actually did. This is where the vendor features stop looking like marketing and start looking like the seed of a real answer.

Durable execution cuts both ways. A system that checkpoints every state transition and can replay them looks, at first glance, like a compliance problem, because its state is hard to snapshot in a fixed moment. But it is also the foundation for continuous audit. A runtime that checkpoints and replays produces, as a side effect of running, the execution trace an auditor would want. The trace is not a feature you bolt on. It falls out of how the runtime already works.

The same direction shows up on the framework side. NIST’s Cybersecurity Framework 2.0, released in 2024, added a sixth function, Govern, to the existing Identify, Protect, Detect, Respond, Recover. And NIST is now publishing guidance for using AI within the CSF: SP 1353, a quick-start guide for using AI in CSF analysis and reporting, open for comment until October 15, 2026, and SP 1347, the final informative-references guide, which includes sample AI use cases implemented with “continuous evaluation and improvement.”

The direction is the same from every angle. The framework is reaching toward continuous, AI-assisted governance, and the runtimes are producing execution traces as a byproduct. What has not happened is the part that matters: nobody has connected the trace to the control objective in a way an assessor would accept.

Keeping the claim honest

“Non-deterministic” is easy to overclaim. LangGraph and CrewAI both support deterministic flows. CrewAI markets “create deterministic agent workflows,” and LangGraph’s state machines let a developer constrain the loop with human-designed structure. The non-determinism does not live in the graph. It lives in the conditional routing, where the model picks the next branch. The honest framing is “a bounded loop with model-routed branches,” not “unbounded autonomy.” A developer who hard-codes the routing has an ordinary state machine, and most of this problem disappears.

Also, OWASP’s complete mediation is a design principle, not a certified control. It gives the vocabulary. It does not give a compliance path. The distance between “authorize in logic, not the model” and “here is the assessment objective you have satisfied” is still the whole problem, and I do not want to pretend otherwise.

Bottom line

The prior post said point-in-time audit cannot certify non-deterministic software. This one sharpens it into something I can stand behind more specifically: the compliance unit for agentic software is the loop, and the loop breaks Access Control and Audit and Accountability first. The fix that is forming, on both the vendor side and the framework side, is to move authorization outside the loop and turn the execution trace into the audit artifact. Both halves exist today as product features and draft guidance. Neither has been accepted by an assessor, and until one is, “certifying the loop” is an aspiration, not a procedure.

Sources

  1. LangGraph — LangChain blog, January 17, 2024
  2. langchain-ai/langgraph — GitHub
  3. CrewAI — Enterprise Agent Build & Runtime
  4. Cybersecurity Framework — NIST
  5. OWASP GenAI LLM Top 10 — GitHub
  6. NIST Cybersecurity Framework — Wikipedia
  7. Cybersecurity Maturity Model Certification — Wikipedia
  8. Practices for Governing Agentic AI Systems — OpenAI, December 14, 2023
  9. LLM03:2026 Excessive Agency — OWASP
  10. NIST SP 800-171 Rev. 3 — NIST