Careful Adoption of Agentic Artificial Intelligence (AI) Services (ASD's ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK joint guidance, 1 May 2026)
Voluntary joint guidance for organizations adopting agentic AI: never grant agents broad or unrestricted access, limit agent permissions to the minimum for approved tasks, treat each agent as a distinct principal with just-in-time credentials for high-impact actions, require prior human approval before agents execute high-impact actions, log and monitor all agent operations, threat-model and red-team agents, and restrict tools to an approved allow list. Announced by CISA on 1 May 2026 (CISA bulletin); text read from the co-sealed PDF published by ASD's ACSC.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Least-privilege credential scoped to task C-E1 | Recommended | Operating agents securely, Privileges and authentication (p. 23): 'Limit privileges of AI agents to the minimum required for its task'; 'Require just-in-time credentials for high-impact or privileged actions'. | high | 5 cases |
| Actor identity verification C-A1 | Recommended | Designing secure agents, Identity management (p. 15): 'construct each agent as a distinct principal'. | medium | 4 cases |
| Destructive-action gate C-E3 | Recommended | Operating agents securely, Human in the loop (p. 22): 'Prevent agents from autonomously executing high impact actions or outputs without prior human approval'. | high | 5 cases |
| Independent audit log C-V1 | Recommended | Operating agents securely, Monitoring and auditing (p. 21): 'Maintain comprehensive logs and real-time monitoring of live agent behaviour and decision-making'. | medium | 1 case |
| Provenance of the actor's software and hardware C-A3 | Recommended | Developing secure agents, Manage third-party components (p. 18): 'Restrict tool use to an approved allow list of tools and versions that are regularly verified as secure'. | medium | 1 case |