An AI agent that can act on your systems is a new kind of user. The National Cyber Security Centre’s interim advice treats it as one, and sizes the controls to how much it is allowed to do.
An AI tool that drafts an email is an assistant. An AI tool that sends the email, books the meeting, raises the ticket and closes it again is something else. It acts on your systems with permissions someone gave it, and until recently that kind of access came with a user account and a named person behind it.
The National Cyber Security Centre (NCSC) published interim advice on this in August. Its blog, “Managing the cyber risk of agentic AI”, dated 20 August 2026, contains one sentence I would put in front of any organisation trialling agents: “All agents should be assigned their own unique identity in a class which differentiates them from human or individual systems.”
That sentence does a lot of work. I read it as saying that an agent is neither a person nor a shared service account, and that it should always be possible to tell which actions an agent took.
Why this is arriving now
In August I wrote about the AI tools already inside most businesses, the ones staff adopt without anyone signing them off. Agents raise the stakes, because an assistant can only suggest while an agent can act.
The guidance has moved quickly. On 1 May 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) announced joint guidance from six agencies in the Five Eyes countries, including the NCSC, titled “Careful Adoption of Agentic Artificial Intelligence (AI) Services”. CISA’s summary names risks including “privilege escalation, emergent behaviors, and accountability gaps”, and its recommendations include “limiting agent autonomy by ensuring agents are not granted broad or unrestricted access”. The NCSC blog followed in August. It describes itself as interim, and says formal guidance is being developed with partners and will supersede it.
Most organisations are early. The government’s Cyber Security Breaches Survey 2025/2026 found that around a third of businesses (31%) were using AI, adopting it or actively considering it. Of that group, around a quarter (24%) had cyber security practices in place to manage the risks from AI. That second figure is the one to watch. It covers AI in general, with no separate figure for agents, and it is already low.
The useful question is autonomy
The NCSC blog starts from how much each agent is allowed to do, and sets the controls to match: “The recommendations in this blog should be applied proportionately based on the level of autonomy each agentic AI system is intended to have.”
It describes three oversight models. With a human in the loop, people approve actions before they happen. With a human on the loop, people monitor actions and can intervene. With a human out of the loop, the agent acts without review. The blog’s logic is simple. The greater an agent’s autonomy, the greater the potential impact if it malfunctions, reaches information it should not or acts outside its intended scope, “and therefore the greater the need for controls”.
This is a more useful frame than a list of approved tools. A tool that drafts replies for a person to send sits at one end. An agent that can change firewall rules overnight sits at the other. They need different controls, and a policy that treats them the same will be too strict for one and too loose for the other.
What an identity means in practice
The identity advice comes down to three controls from the blog, and a fourth I would add.
First, each agent gets its own identity, in a class separate from people. No borrowing a member of staff’s account, and no shared credentials across agents.
Second, least privilege: “Ensure it has only the permissions it needs for the task being performed and use credentials with the shortest possible lifetime.” Long-lived keys pasted into a configuration file are the opposite of this.
Third, its activity is logged and watched like anyone else’s. “Agentic AI activity should be treated as a form of user activity.” The blog goes on to say it should be included in 24/7 security monitoring and incident response.
The fourth is mine: every action should be attributable inside the organisation. If an agent changes a record, the audit trail should say which agent, acting for whom, under which instruction. The blog makes the related point for outsiders: if an agent contacts third-party systems, make it as easy as possible for those organisations to see that the activity comes from you.
None of this is new to anyone who runs identity and access management. That is the point. The skills that make multi-factor authentication work on every cloud service that offers it, which Cyber Essentials now checks, are the same skills that will decide whether agents can be trusted. Microsoft’s SC-900 fundamentals exam outline, from 21 October 2026, asks candidates to describe types of identities, “including workload identities”, the non-human identities that sit closest to agents.
Containment and the off switch
Identity limits what an agent may do. Containment limits what happens when it does something unexpected. The blog sets out two four-level ladders for the agent’s sandbox. For networks, the levels run from unrestricted access, through an allowlist of approved domains and access to the model’s API alone, to no external network access with the model hosted locally. For compute, they run from no isolation, through containers and virtual machines, to dedicated hardware.
It also gives two pieces of operational advice I would adopt immediately. Run initial experiments in office hours, “when more human oversight is available”. And keep the ability to stop everything: “you should always be able to ‘pull the plug’ and halt autonomous AI agent activity immediately.”
The blog is also blunt about prompts. A well-written instruction is not enough on its own: “do not rely on prompting alone.” An agent, it reminds readers, “does not have common sense or human traits, and may interpret instructions and goals in literal or unexpected ways.”
The counterpoint: much of this is out of your hands
The fair objection is that many organisations will not build agents. They will switch on agent features inside software they already pay for, and the identity, logging and sandboxing will be the supplier’s design.
That is true, and it changes the work without removing it. The same questions become questions for the supplier. Does each agent run under its own identity? Can we see its actions in our logs? What permissions does it hold by default, and can we reduce them? How do we stop it? A supplier that cannot answer is telling you something about the autonomy you would be granting.
The second objection is that the advice is interim. It is, and the NCSC says so. But the direction is unlikely to reverse. Unique identities, least privilege, logging and a working off switch are not controversial ideas, and an organisation that adopts them now will have less to change when the formal guidance arrives.
Before you switch an agent on
The practical test is short. Before an agent goes live, someone should be able to say what level of autonomy it has, which identity it runs under and what that identity can reach, how long its credentials last, where its actions are logged and who reads them, which sandbox level it runs at, and who can stop it, and how quickly.
If any of those answers is “we’re not sure”, the agent is not ready, whatever it was bought to do.
This article is commentary on published guidance, not legal or security advice. The NCSC describes its blog as interim advice that formal guidance will supersede. Sources checked on 7 October 2026.
Sources
- NCSC, Managing the cyber risk of agentic AI, blog by Toby W, Principal Security Architect, 20 August 2026: https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai
- CISA, CISA and Partners Release Guidance on Adopting Agentic AI Services, 1 May 2026, on the joint guidance “Careful Adoption of Agentic Artificial Intelligence (AI) Services”: https://content.govdelivery.com/accounts/USDHSCISA/bulletins/41544ff
- Canadian Centre for Cyber Security, Joint guidance on the careful adoption of agentic artificial intelligence services (list of co-authoring agencies): https://www.cyber.gc.ca/en/news-events/joint-guidance-careful-adoption-agentic-artificial-intelligence-services
- DSIT and Home Office, Cyber Security Breaches Survey 2025/2026, 30 April 2026: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- Microsoft Learn, Study guide for Exam SC-900 (skills measured as of 21 October 2026): https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-900