Securing Agentic AI Enterprise Workflows Against Prompt Injection Tool Poisoning Memory Manipulation and Excessive Agency Threats

Agentic artificial intelligence systems extend language models with planning, memory, tool invocation, data access, and autonomous action, creating enterprise capabilities that also expand the security boundary beyond prompt-response applications. This review examines how prompt injection, tool poisoning, memory manipulation, and excessive agency threaten agentic workflows across finance, healthcare, software development, customer operations, and critical business services. It analyzes direct and indirect prompt injection through user inputs, retrieved documents, webpages, emails, databases, and multimodal content, emphasizing how untrusted instructions can override policy or redirect plans. Tool poisoning is examined through malicious descriptions, compromised connectors, deceptive outputs, dependency tampering, and excessive permissions that enable unauthorized data access or transactions. The review further evaluates memory attacks through false fact insertion, persistence abuse, cross-session contamination, sensitive-data retention, and retrieval manipulation. Excessive agency is framed as a control failure arising when agents possess broad objectives, inadequate constraints, irreversible tools, or weak human oversight. Defensive approaches include instruction-data separation, contextual trust labeling, least-privilege authorization, capability-based tool access, schema validation, content sanitization, provenance tracking, memory partitioning, transactional safeguards, runtime policy enforcement, and human approval for consequential actions. Detection methods combining behavioral telemetry, execution graphs, anomaly scoring, canary resources, and policy-violation monitoring are compared using attack success rate, false alarms, intervention latency, task utility, and operational cost. The paper proposes a defense-in-depth framework spanning design-time threat modeling, pre-execution validation, constrained planning, monitored tool use, post-action verification, and recoverable state management. Key challenges include adaptive adversaries, ambiguous instruction hierarchies, third-party integrations, long-horizon attacks, evaluation realism, and the trade-off between autonomy and control. The review argues that secure enterprise deployment requires treating agentic artificial intelligence as a privileged software actor whose intentions, capabilities, memory, actions, and consequences must remain authenticated, bounded,