The guidance is not asking for another AI policy document
The Australian Signals Directorate’s Australian Cyber Security Centre co-authored the guidance with CISA, NSA, the Canadian Centre for Cyber Security, NCSC-NZ, and NCSC-UK. Its central message is operational: agentic systems can plan, use tools, access data, delegate, and act without continuous human intervention, so established cyber controls must extend into the agent’s live execution path.
That matters because an agent can be authenticated, correctly configured, and still misunderstand a goal, be influenced by untrusted context, choose the wrong tool, exceed the intended scope, or propagate a compromised instruction across multiple steps. The guidance therefore combines conventional controls—identity, least privilege, secure development, supply-chain management, logging, and incident response—with agent-specific controls such as bounded planning, tool-response validation, behavioural monitoring, and human approval for high-impact actions.
AgenticDome does not make an organisation compliant with this guidance. It provides a technical control and evidence layer for selected runtime requirements: evaluate proposed actions before execution, carry actor and agent identity into policy, verify delegated authority, review supported outputs, observe behavioural patterns, and export structured decision telemetry.
What changes when AgenticDome is in the path
At an application-controlled prompt, tool, delegation, MCP, or output boundary, AgenticDome sends the proposed interaction to the tenant’s assigned runtime. The runtime evaluates available identity, purpose, tool, arguments, session, lineage, policy, trust, and behavioural context, then returns the configured decision. The application enforces that decision before the protected action proceeds. High-impact approval workflows, sandbox infrastructure, IAM, and accountable human ownership remain separate controls that must be deliberately designed and operated.
Where AgenticDome contributes to the guidance
The value is not a claim of one-to-one regulatory compliance. It is the ability to make selected security requirements observable and enforceable at the moment an agent proposes an action.
Constrain actions before impact
Apply tenant policy to supported prompts, tools, MCP calls, graph transitions, and delegations before the protected application crosses the execution boundary.
Join identity with intent
Carry the authenticated human or workload, agent identity, role, purpose, session, and proposed action into the same decision instead of treating a valid credential as sufficient proof.
Observe behaviour over time
Record tenant-scoped runtime events and, where configured, use behavioural windows and trust controls to identify or contain patterns that a single API request cannot reveal.
Create reviewable evidence
Capture structured decisions and action context for operations, incident review, assurance, and customer-configured SIEM or webhook export without presenting the evidence as certification.
Use AgenticDome as one layer in defence in depth
Begin with a tightly bounded use case and identify the final application-controlled boundary before a real action. Keep IAM, secure tool design, data governance, sandboxing, human approval, rollback, and incident response in place. Add AgenticDome where the application can reliably enforce the returned decision, then test allowed, blocked, unavailable, delegated, and manipulated-input paths before expanding scope.
How AgenticDome creates the control point
1. Identify the actor and agent
Preserve authenticated human or workload identity and a stable agent identity; do not infer identity from display names or prompts.
2. Classify the proposed action
Pass the tool, final arguments, purpose, target, privilege context, and reversibility or impact signals available to the application.
3. Decide before execution
Enforce the runtime verdict at the last responsible moment, after arguments are final but before the protected tool or external service is called.
4. Verify delegated authority
Where agents hand work to specialists, bind and verify the source, target, tool, arguments, tenant, session, and authorization context.
5. Monitor and improve
Use decision telemetry, behavioural evidence, red-team results, and incidents to tune policy and determine whether the use case should remain bounded, expand, or stop.
What this changes for real teams
Turn a control statement into an operating control
“Our policy says agents must not perform high-impact actions without appropriate authority, but we need evidence from the live workflow.”
AgenticDome contribution: AgenticDome can block configured high-impact actions lacking the required role, purpose, scope, trust, topology, or other policy context and retain the decision evidence. The organisation still defines and operates any human approval process.
Avoid a different security pattern for every framework
“We run Microsoft, MCP, Python, cloud, and custom agent paths and need a consistent enforcement vocabulary.”
AgenticDome contribution: Supported adapters place the same tenant policy concepts—actor, agent, purpose, tool, arguments, session, delegation, and output—at the boundary each platform actually exposes.
See the action chain, not only the final API call
“A downstream log shows a valid service principal, but not the user request, source agent, delegation, policy decision, or reason for the action.”
AgenticDome contribution: AgenticDome records structured runtime context and can stream selected telemetry to a configured SIEM or webhook so investigators can correlate identity, agent activity, tool use, and verdicts.
The risks this helps contain
| Risk | Why it matters | Public AgenticDome control |
|---|---|---|
| Broad or drifting privilege | The guidance warns that privilege lapses can change a minor agent error into a catastrophic event. | Use IAM for actual entitlement and AgenticDome policy to evaluate supported high-impact, financial, identity, topology, role, purpose, scope, and trust conditions before action. |
| Untrusted input or tool response | External data and returned tool content can introduce indirect instructions into the model context. | Screen supported input boundaries and review configured tool, MCP, retrieval, streaming, or output paths before the content is reused or returned. |
| Unapproved high-impact action | Deletion, network egress, privilege change, and other hard-to-reverse actions require deliberate human control points. | Block the protected action when policy requirements are unmet and provide a decision for the surrounding workflow. AgenticDome does not itself replace the customer’s approval system or accountable approver. |
| Uncontrolled delegation | Authority can be lost or inflated as work moves between orchestrators, managers, specialists, and tools. | Authorize and verify supported handoffs with tenant, actor, source, target, session, tool, argument, lineage, expiry, and consumption constraints. |
| Multi-step behavioural drift | A sequence of individually plausible actions can form an unsafe pattern or exceed the intended task. | Use stable session and actor context plus configured behavioural monitoring, trust thresholds, rate controls, and incident telemetry; do not claim coverage where calls bypass the protected boundary. |
| Third-party tool and supply-chain risk | Models, tools, MCP servers, libraries, and retrieved data expand the system’s trust surface. | Apply runtime authorization and, where configured, signed tool-provenance bindings to the exact approved tool identity, version, and digest. This complements—not replaces—vendor assessment, SBOM, signing, and secure procurement. |
A practical path to production
Bound the use case
Start with a well-understood, reversible, low-risk task and document why an agent is preferable to simpler automation.
Set identity and privilege
Give each agent a stable identity and minimum entitlements; preserve the originating human or workload where available.
Wire every critical boundary
Protect the actual prompt, tool, handoff, MCP, retrieval, and output paths relevant to the threat model; remove unguarded bypass routes.
Prove failure safely
Test prompt injection, wrong role, altered arguments, replay, timeout, output leakage, rollback, and incident response before production expansion.
Where this control ends
AgenticDome supports selected runtime security and evidence requirements; it does not certify alignment with ASD guidance, the ISM, the Australian AI Ethics Principles, NIST, or any law. It does not replace IAM, endpoint and network security, model evaluation, secure development, SBOM and supplier assurance, sandbox operation, data governance, privacy and legal review, human approval workflows, backups, rollback, incident response, or accountable executive ownership. Coverage exists only at correctly integrated and tested boundaries.
Current lifecycle note
The joint publication is guidance, not a product certification scheme. Its strongest recommendation is to adopt agentic AI cautiously, begin with low-risk tasks, preserve meaningful human accountability, and prefer resilience and containment over unbounded efficiency. Reassess the guidance and the system threat model as agent capabilities and standards evolve.