Five Eyes Guidance on the Careful Adoption of Agentic AI Services
Issued by
CISA and NSA (US), ASD's ACSC (Australia), the Canadian Centre for Cyber Security, New Zealand's NCSC, and the UK's NCSC
- September 30, 2026 · Correction — Corrected the publication date (1 May 2026) and co-authors, and labeled it as agency guidance rather than a requirement. (Cody Maxwell)
- September 30, 2026 · Correction — Corrected the authorship (six agencies jointly), removed an invented document number, narrowed the stated scope, and described recommendations as advisory (fact-check finding). (Cody Maxwell)
- October 1, 2026 · Correction — Rewrote the practical steps, newsletter hook, search description, and audience fields to match the entry's corrected content. (Cody Maxwell)
This joint Five Eyes advisory addresses enterprises and public bodies deploying autonomous AI agents. It covers agents taking independent actions, accessing systems, or interacting with other agents. The guidance calls for low-risk tasks, minimum necessary access, and integration into existing security governance.
Applies To
Overview
Six agencies jointly published this guidance on 1 May 2026. They are CISA and the NSA (US), Australia's ACSC, the Canadian Centre for Cyber Security, New Zealand's NCSC, and the UK's NCSC. It focuses mainly on agentic AI systems built on large language models. It addresses the distinct security risks posed by agentic AI systems that plan, act, and coordinate without continuous human direction. The guidance establishes principles for scoping agent permissions, managing trust boundaries between agents (limits on what one agent will accept from another), and ensuring human accountability for autonomous decisions. Key provisions cover zero trust architecture (checking every agent request to a system instead of trusting it by default) and unified logging standards for agent activity. They also set explicit limits on the sensitivity of tasks that may be delegated to autonomous agents. Enforcement is advisory in nature, meaning the document carries no direct penalty mechanism, but it signals regulatory expectations that may inform future binding rules across Five Eyes member states. Organizations in critical infrastructure sectors should treat conformance as a baseline expectation given the agencies involved and the reputational weight of joint Five Eyes publications.
Key Requirements
- •Restrict agentic AI to low-risk, non-sensitive tasks until organizational maturity and security controls are verified
- •Apply least-privilege access principles to all AI agents, limiting permissions to only what each agent requires to complete its designated function
- •Establish and enforce trust boundaries between agents in multi-agent architectures, preventing unauthorized lateral movement or privilege escalation
- •Implement unified, tamper-evident logging of all agent actions to support auditability and incident response
- •Assign clear human accountability for the outcomes of autonomous agent actions, including defined escalation paths when agents exceed expected behavior
- •Integrate agentic AI systems into existing security governance frameworks, including risk assessments, vendor management, and incident response plans
What Your Organization Must Do
- →Map where your organization already uses AI agents that act or access systems without constant human direction.
- →Limit agent permissions to the minimum each task needs, and document who approved each permission set.
- →Restrict agents to low-risk, non-sensitive tasks until your controls and maturity are verified.
- →Extend existing security logging to capture agent actions, decisions and system interactions for later review.
- →Name an accountable human owner for each agent, with escalation paths when behavior exceeds expectations.
- →Add least-privilege and logging checks to procurement questions for vendor-supplied agentic AI services.
Playbook Guidance
Step-by-step implementation guidance for compliance teams.
Governance Controls
Operational controls that implement requirements from this regulation.
Frequently Asked Questions
- Is the Five Eyes agentic AI guidance legally binding on US organizations?
- No, the guidance is advisory and carries no penalties. Given the agencies involved, critical infrastructure operators should still treat it as a baseline that may shape future rules.
- Which types of AI systems fall within the scope of the Five Eyes agentic AI advisory?
- The guidance focuses mainly on agentic AI systems built on large language models. These are systems that plan, act, or coordinate with limited human direction, such as agents that access enterprise systems or carry out multi-step tasks.
- What does the Five Eyes guidance recommend for multi-agent architectures specifically?
- It recommends explicit trust boundaries between agents, so that one agent cannot use another to move into other systems or gain privileges. It also recommends zero trust principles for agent access to systems, with each agent's permissions scoped to its task.
- How does the Five Eyes agentic AI advisory treat logging and auditability?
- It recommends logging agent actions, decisions, and system interactions in a way that supports incident response and later review. Many organizations will do this by extending their existing security monitoring to cover agent activity.
- Does the Five Eyes agentic AI guidance apply to third-party or vendor-supplied AI agents?
- Yes, the guidance treats third-party agentic services as part of the deploying organization's risk. It recommends checking during procurement that vendors meet least-privilege and logging expectations. Accountability stays with the deployer.
- How does the Five Eyes guidance compare to the EU AI Act for organizations deploying autonomous AI agents?
- The EU AI Act sets binding obligations with penalties tied to risk classification. The Five Eyes document is non-binding cybersecurity guidance for agentic systems. Use it to strengthen security practice alongside, not instead of, EU AI Act compliance.