NCSC has written the rules for AI that acts on its own
Somewhere in your business, probably this quarter, someone has connected an AI tool to something real: an inbox, a code repository, a customer system, a folder of files. Not AI that answers questions, AI that acts*. The vendors call this agentic AI, and the useful way to think about it is simple: an AI agent is software you give goals and access to, and it decides the steps itself. The question that matters is not whether it is impressive. It is what happens when it does something you did not ask for, and this week the National Cyber Security Centre published practical rules for exactly that.
The guidance is interim, based on NCSC's own research, with formal guidance to follow and supersede it. It is aimed at people building and running agents with real autonomy, but the thinking in it is useful to any business deciding how far to let this technology in. NCSC's prompt for writing it is blunt: there have been several recent incidents of AI systems carrying out "unsanctioned or unintended activity". This is not a hypothetical risk, and we covered a live example of it in an earlier filing on AI agents connected to real tools.
Autonomy is a dial, not a default
The guidance's first move is its best one: before any technical control, decide how much autonomy the agent actually needs. Some agents only suggest, and a human acts. Some act with a human approving each step. Some act entirely alone. NCSC frames these as human-in-the-loop, human-on-the-loop, and human-out-of-the-loop, and the choice sets everything else: the more freely the agent acts, the more damage a mistake or a compromise can do, and the stronger the controls need to be.
The second move is just as practical: do not rely on the safety features built into the AI model itself. NCSC is direct about this. Built-in safeguards "can be bypassed" and are not sufficient on their own in higher-risk settings. The protections that count are the ones you put around the agent, not the ones the vendor put inside it.
Think about everything the agent can touch
The core of the guidance is about the agent's environment. NCSC's advice is to run every agent in a sandbox, a contained environment that controls what it can reach, and to think about the boundary in five directions: where the agent's code runs, what it can reach over the network, what it can do on the machine itself, what identities and credentials it can use, and what data it can see. An agent is not just a chat window. It is the sum of everything it can touch, directly or indirectly. NCSC calls this its blast radius, and the design goal is to keep it as small as the task allows.
Two specifics are worth lifting out because they are unusually concrete for guidance at this stage:
Network access has a maturity ladder. Level 1 is unrestricted internet access. Level 2 restricts the agent to an approved list of destinations. Level 3 allows it to reach only the AI model's own service. Level 4 is no external access at all, with the model running inside the sandbox. NCSC's recommended default posture is deny everything, then allow only what the task requires. If you do nothing else, knowing which level your agent sits at is a one-question health check.
Every agent gets its own identity. Give each agent a distinct account, limit its permissions to the task in hand, and prefer short-lived credentials. Count every API key, login session, and access grant the agent holds as part of its blast radius. This also makes the agent's actions attributable: when something odd happens at 2am, you can tell which agent did it, and switch that one off, without guessing.
The guidance also insists on the unglamorous pair that makes all of the above workable: logging and a kill switch. Record what agents do, monitor it as part of normal security operations, put a named person in charge of agent activity, and keep the ability to pull the plug, quickly, when something goes wrong.
AI that acts*
The asterisk matters, because "acts" includes agents that only read. It is tempting to treat read-only access as the safe setting: the agent cannot delete anything, so what harm can it do? But an agent that can see private information, read content from the outside world, and make outbound connections has everything it needs to leak what it reads. A booby-trapped web page or document can quietly instruct it to tuck private data into the next web address it visits, and no write access is required at any point. Even fetching a page is an action in its own right: a simple request can trigger confirmations, webhooks, and password-reset flows at the other end.
This is exactly why NCSC's network ladder matters for read-heavy agents. An approved list of destinations, level 2 on the ladder, is the control that closes the leak route, which read-only permissions never did.
What to take from it at SME scale
If your team is building with agents, the guidance is your checklist, and it is refreshingly buildable: pick the autonomy level deliberately, threat-model what could go wrong before deployment, deny-by-default networking, one identity per agent, logs, kill switch. It also carries a warning worth taking seriously: agents can discover weaknesses in their own controls, so a single layer of sandboxing is not enough for high-stakes work.
If you are buying rather than building, the guidance converts into supplier questions. Which of the four network levels does this run at? Whose identity does the agent act as, and can it be given its own? What is logged, and can we see it? How do we turn it off? A vendor who cannot answer those has not read the room, because the most citable security authority in the UK has now written the questions down.
And if you are simply deciding your business's position on AI, this slots alongside NCSC's earlier agentic AI guidance we covered in May: let staff use AI tools that suggest, be deliberate and controlled about AI that acts, and treat "what can it touch?" as the first question, not the last.
How Steelwise can help
Working out how much autonomy an AI tool should get in your business, and what needs to sit around it before it touches anything real, is the kind of AI review we do. Get in touch.