Careful Adoption of Agentic AI Services: the Five Eyes guidance explained

What was published and who stands behind it

This guide answers one question: what do CISA, NSA, ASD's ACSC and their partners recommend that security leaders do before and while adopting agentic AI services? It uses only the joint guidance and the CISA and NSA announcements about it. Each factual statement below is attributed to one of those documents. The sections follow the order in which a security leader meets the decisions: what to settle before adoption, what to build in during design, what to test, and what the sources say about running agents.

CISA's press release carries the date May 1, 2026, and its subheading says the guidance helps organizations secure agentic AI systems and defend against future cybersecurity risks.

NSA's announcement names the agencies that co-sealed the document besides NSA and ASD's ACSC: the Canadian Centre for Cyber Security, CISA, the New Zealand National Cyber Security Centre and the United Kingdom National Cyber Security Centre.

The guidance says agentic AI systems are intended to operate without continuous human intervention. Limits on access, scope and oversight run through the recommendations covered next, and the sections below show where each one comes from.

What the agencies ask leaders to settle before adopting

The first group of recommendations is about how much access an agent gets and where it is used first.

In the actionable recommendations listed in its press release, CISA says organizations using agentic AI should avoid granting broad or unrestricted access, especially to sensitive data or critical systems.

The same list says to begin with agentic AI use cases that are low-risk and non-sensitive.

It also says to account for agentic AI security in the organization's security model and risk posture.

The guidance itself says organisations should only use agentic AI for low-risk and non-sensitive tasks.

It adds that the authoring agencies strongly recommend aligning agentic AI risks and mitigation strategies with the organisation's existing security model and risk posture.

The guidance also says organisations should address AI security, including agentic AI systems, within established cyber security frameworks rather than treating it as a separate or standalone discipline.

For prerequisites, the guidance points to Appendix A, which it says provides a breakdown of cyber security prerequisites to consider before incorporating AI agents.

The text of Appendix A was not among the documents supplied for this guide, so its contents are not listed here. In plain terms, the before-adoption position is to start small, keep access narrow and fit the agent into the risk model the organisation already has. In other words, the guidance treats agentic AI security as part of the security work already under way rather than as a new discipline.

Controls the guidance asks for when designing agents

The guidance has a design section aimed first at developers, and it says vendors and operators may want to reference it when sourcing AI agents.

The guidance says privilege risks are a key concern for agentic AI and strict adherence to the principle of least privilege is critical.

On identity, it says developers should construct each agent as a distinct principal, which it describes as a cryptographically anchored identity with its own unique keys or certificates.

On oversight, the recommended practices include implementing human control points throughout the agent workflow, such as live monitoring and interruption during task execution and mandatory human approval for decision-making steps.

On defence in depth, the guidance says to avoid reliance on a single security mechanism by implementing multiple, overlapping layers of security controls.

Together these four items cover who the agent is, what it can reach, who watches it and what happens when one control fails. They sit alongside the before-adoption points and do not replace them. The four items give a short list of what the guidance names in this section.

Testing, resilience and third-party components

The development advice recommends deploying sandbox environments to test agent behaviour before production deployment.

It also recommends versioning and rollback mechanisms to safely revert a system to known-good agent behaviours when unpredictability is observed.

On third-party tools and components, the guidance says verification and management of third-party components of agentic applications can reduce the added risk.

The supplied text of the guidance ends partway through this third-party section, so later items in it are not covered here. Read together, the three items say to test before production, keep a way back to a known-good state, and verify what is connected to the agent.

What the sources say about deployment and operation

NSA's announcement says the report recommends deploying agentic AI incrementally, continuously assessing against evolving threat models, and maintaining strong governance, explicit accountability, rigorous monitoring and human oversight, which it calls essential for safe and secure operation.

Because the supplied copy of the guidance stops before its sections on deploying and operating agents, this guide relies on NSA's summary for those stages and adds no detail of its own. NSA lists these items together, and the sources supplied give no order or ranking among them. The word incrementally is the only pacing term in NSA's announcement; it gives no timetable or stage names.

For a security leader, that means the recommended pattern covers the whole life of an agent: a limited start, controls built in, testing, and continuing oversight.

A note on CISA's resource page wording

CISA's resource page for the guidance says CISA released guidance for organizations on adopting agentic super intelligence (SI) systems. This guide uses the term agentic AI, as the guidance does. Where the sources differ in wording, as on CISA's resource page, this guide says so rather than choosing between them.

Limits of this reading

This guide does not rank the recommendations, judge the guidance or add steps the agencies did not give. Readers who need the Appendix A prerequisites, the deployment and operation steps or the detail behind each risk category will need the complete guidance, because the supplied text covers them only in part.