Agentic AI: Turning Guardrails into Reality

The race, and the risk

AI agents are systems that can plan, use tools, and take actions on someone’s behalf with limited supervision. They book, buy, write code, update records, send messages, and call other agents. Organisations are adopting them at speed because the competitive advantage is real: work that took days can now take minutes.

That pressure is exactly the problem. When competitors move fast, everyone is tempted to cut corners on safety (Shavit et al., 2023). A chatbot that gets something wrong produces a bad answer. An agent that gets something wrong, or is manipulated by an attacker, produces a bad action, using whatever data, credentials, and privileges it has been given.

It is not suggested that we suddenly stop. However there is an argument for proportion. Guardrails should be matched to risk and applied in layers, so that low-risk agents move quickly and high-risk agents earn their autonomy.

What the industry and governments agree on

The good news is that the major industry players broadly agree, and very little of what they say is new. As the UK’s National Cyber Security Centre puts it, securing agents is mostly about applying established principles such as least privilege and defence in depth to a new context. The fundamentals endure.

Principle	What it means in practice	Sources
Know what you have	Keep a trusted registry of agents, reconcile it against what is actually running, and deny access to anything not on it	Five Eyes joint guidance
Bound the risk upfront	Define scope and “red lines” before deployment; limit autonomy, tools, and data access by design	NCSC, IMDA
Unique identity, least privilege	Every agent gets its own identity and minimal, short-lived credentials	NCSC, NIST CAISI
Human oversight matched to impact	High-impact actions need prior human approval, and people, not the agent, decide where those checkpoints sit	Five Eyes, IMDA
Named human accountability	A real person or team is responsible for every agent	IMDA, OpenAI
Legible and attributable	Log what agents do, protect those logs, and make their activity traceable back to you	NCSC, OpenAI
Interruptible	You can halt an agent quickly and cut its access	NCSC, OpenAI
Start narrow, earn autonomy	Begin with clearly defined, low-risk tasks and widen scope gradually as confidence grows	Five Eyes, NCSC

Two further points matter. First, model-level safeguards are a baseline, not a control you can rely on alone; the NCSC is explicit that they can be bypassed. Second, agents have their own class of threats, catalogued in the OWASP Top 10 for Agentic Applications, from attackers redirecting an agent’s goals to agents misusing the tools and privileges they hold.

The NCSC offers a simple test that cuts through the detail: if you cannot understand, monitor, and contain what an agent does, it isn’t ready for deployment (NCSC).

Making it real

Principles are easy to agree with. The hard part is applying them inside an organisation where agents are already arriving through SaaS products, developer tools, low-code platforms, and enthusiastic teams. Three steps turn the guidance into something that actually happens.

Step 1: Catalogue every agent

At the very least, every organisation should have a catalogue of its AI agents and how they are used. Nothing else on this page works without it. You cannot apply least privilege to an agent you don’t know exists, and you cannot stop an agent if nobody knows who owns it. As the NCSC says of shadow AI: you cannot manage what you do not know (NCSC).

A useful catalogue entry doesn’t need to be elaborate. For each agent, record:

• Name and identifier, and the identity it runs as
• Named owner: a person, not a team mailbox
• Purpose and red lines: what it is for, and what it must never do
• Platform and model: who built it, which model or vendor sits underneath
• Access: the tools, systems, and data it can reach, and its credentials
• Autonomy level: does a human approve, supervise, or neither?
• Risk tier (see below)
• Where its logs go, and how to stop it
• Next review date

Finding agents is the harder part, because many are not built centrally. Look at OAuth grants and API keys in your identity platform, procurement and expense records, network traffic to model provider APIs, the agent features switched on in your SaaS estate, and any MCP servers or tool connectors in use. Then ask people directly. An amnesty, where teams can declare what they’re using without penalty, will surface more than any scan.

Finally, make the catalogue the front door. No entry, no credentials, no production access. That single gate turns a one-off inventory into a living control, and it is exactly what the Five Eyes guidance means by denying access to agents not in the registry.

Step 2: Tier by risk

Not every agent deserves the same scrutiny. Treating a meeting summariser like a payments agent wastes effort and breeds resentment; treating a payments agent like a summariser invites disaster. The Five Eyes guidance suggests classifying agent actions by impact, likelihood, and reversibility. A simple three-tier model works for most organisations:

• Tier 1, assistive: reads and suggests, but a human takes the action. Example: drafting replies, summarising documents.
• Tier 2, delegated: takes actions within bounded systems, and those actions can be undone. Example: updating tickets, triaging alerts, editing internal documents.
• Tier 3, autonomous or high-impact: takes actions that are irreversible, external, financial, or touch sensitive personal data. Example: issuing refunds, changing access rights, contacting customers, deploying code.

When in doubt, tier up. An agent’s tier is set by the most consequential thing it can do, not the thing it usually does.

Step 3: Layer the controls

With a catalogue and tiers in place, guardrails become proportionate rather than arbitrary. Each tier inherits everything below it:

Control layer	Tier 1	Tier 2	Tier 3
Catalogue entry, named owner, defined purpose	✓	✓	✓
Activity logging and user transparency	✓	✓	✓
Unique identity, least privilege, short-lived credentials		✓	✓
Sandboxing and network allowlists		✓	✓
Pre-deployment threat modelling and testing		✓	✓
Human approval before high-impact actions			✓
Real-time monitoring and alerting, logs feeding the SOC			✓
Tested kill switch and incident playbook			✓
Independent review and periodic red-teaming			✓

This is what the NCSC means when it says controls should be applied proportionately to each agent’s level of autonomy. It also gives teams a clear deal: stay in Tier 1 and move fast, or accept more controls in exchange for more autonomy.

A first 90 days

For an organisation starting from nothing, a realistic sequence looks like this:

1. Weeks 1 to 4: discover and catalogue. Run the discovery sweep and the amnesty. Accept that the first catalogue will be incomplete.
2. Weeks 5 to 8: tier and triage. Assign every agent a tier and owner. Find the Tier 3 agents with no human approval, no logging, or broad standing credentials, and fix those first.
3. Weeks 9 to 12: install the gate. Make the catalogue a prerequisite for credentials and production access, and set a review cycle.

None of this is perfect control. It is a semblance of control, and that is the point: a known, owned, tiered estate is something you can improve. An unknown one is not.

Why this matters

Agents will deliver real value, and the organisations that adopt them well will gain a lasting edge. But adopting them well means being humble about what we don’t yet understand, collaborative across security, engineering, and the business, and ambitious enough to build guardrails that enable speed rather than block it. These are the principles of the Bletchley Park Model, applied to one of the defining challenges of this moment.

Start with the catalogue. Everything else follows.

Sources and further reading

• NCSC, Managing the cyber risk of agentic AI (2026)
• NCSC, Thinking carefully before adopting agentic AI (2026)
• NCSC, The hidden risks of shadow AI (2026)
• Five Eyes cyber security agencies, Careful adoption of agentic AI services (2026)
• OWASP GenAI Security Project, Top 10 for Agentic Applications for 2026
• NIST Center for AI Standards and Innovation, AI Agent Standards Initiative
• IMDA Singapore, Model AI Governance Framework for Agentic AI (2026)
• Shavit et al., OpenAI, Practices for Governing Agentic AI Systems (2023)