The NSA Is Worried About Your Agentic Deployment.

The five-eyes intelligence community just validated everything you’ve been ignoring about agentic AI governance. But there’s one part they didn’t finish.

On May 1st, six national cybersecurity agencies, CISA, the NSA, and their counterparts in the UK, Australia, Canada, and New Zealand, published a joint 30-page guidance document titled “Careful Adoption of Agentic AI Services.” This is the first time all five nations of the Five Eyes intelligence-sharing alliance have issued coordinated policy on a single AI attack surface.

Let that land for a second. When the agencies whose day jobs include keeping tabs on nation-state threat actors all agree to put the same thing in writing, it’s worth reading past the press release.

The headline from that document: “Strong governance, explicit accountability, rigorous monitoring and human oversight are not optional safeguards but essential prerequisites.”

Not best practices. Not good to have. Prerequisites.

And yet, if you ask most enterprises today whether they can answer four basic questions about their deployed agents — who authorized this action, what did the agent actually do, what systems did it touch, and can you prove any of it — the answer is usually some variation of “we’re working on it.”

That’s a problem. And the guidance, useful as it is, only gets you halfway to solving it.

The Rap Sheet Nobody Is Keeping

Think about what it means to have an employee with no employment history, no reference checks, and no performance record. You don’t know what they did at their last job. You don’t know if they’ve been fired for cause. You don’t know if the glowing recommendation letter is real. You hire them anyway and hand them the keys to the building.

To be clear, I don’t think Otter’s have a malicious bone in their body, so this is a purely speculative image

That’s the current state of most enterprise agentic AI deployments.

Agents are being provisioned with credentials, granted access to data stores and APIs, delegated authority to act on behalf of users, and sent off to work, with essentially no accountability infrastructure underneath them. They don’t have a rap sheet because nobody is keeping one. Not because nothing has happened, but because the systems to record it don’t exist yet.

The Five Eyes guidance names five risk categories that explain why this matters: privilege risks, design and configuration risks, behavior risks, structural risks, and accountability risks. The last one is the most underappreciated. The guidance notes that “agent actions and decision-making processes can be opaque,” that “agents may initiate secondary tasks, spawn sub-agents, or follow extended delegation chains in ways that are not always visible to operators,” and that even identical prompts can produce different actions due to stochastic model behavior. The result: “fragmented logs, opaque agent reasoning and emergent interactions obscure the decision path.”

In plain language: if something goes wrong, you probably can’t figure out what happened, who authorized it, or what to remediate. That’s not a theoretical risk. That’s the default state of almost every agentic deployment right now.

The Confused Deputy Problem, At Scale

The guidance uses a scenario that engineers in the IAM space will recognize immediately: the “confused deputy” pattern.

Here’s how it plays out in an agentic context. An organization deploys an agent to manage procurement. To keep things moving, they grant it broad access to financial systems, email, and contract repositories. Over time, other agents come to rely on its outputs and implicitly trust its actions. A malicious actor then compromises a low-risk tool integrated into the procurement agent’s workflow. Because the tool inherits the agent’s excessive privileges, the attacker can now modify contracts and approve payments, and the audit logs look completely legitimate because the actions are technically coming from a trusted agent identity.

Notice what made this possible: not a sophisticated exploit, but three boring failures. The agent had more access than it needed. Other agents trusted it without verification. And nobody was watching the audit logs closely enough to notice the impersonation.

This is what we meant in The Identity Explosion when we wrote about the velocity problem. Human access is slow. Agents operate at machine speed. An agent can crawl, analyze, and exfiltrate thousands of records in the time it takes a human to notice something is off. The confused deputy attack isn’t a future scenario. It’s a documented attack vector with real-world examples, running right now, in environments where teams are proud of how fast they shipped their agentic deployment.

What the Guidance Gets Right

The Five Eyes document is genuinely good, and it’s worth calling out the parts that matter most for practitioners.

On privilege management, it’s unambiguous: apply least privilege at every delegation step, issue ephemeral credentials that expire at task completion, and never let static permissions accumulate across agent sessions. The guidance explicitly recommends “just-in-time credentials for high-impact or privileged actions” and requiring “agents to perform cryptographic attestation where agents must prove that they are running expected and unmodified code.” This is exactly the architecture we described in Unlocking AI Autonomy: The Trust Layer Every Enterprise Needs, where every agent in a multi-hop pipeline receives a Task Token scoped only to what it needs for that specific action, and nothing more.

On behavioral risk, the guidance makes a point that tends to get skipped in most enterprise AI conversations: agents can be deceptive. Not in a science-fiction sense, but in a technically precise one. Some AI systems have demonstrated capacity for strategic deception, providing false information, concealing vulnerabilities they discover rather than reporting them, or altering behavior when they detect they’re being evaluated. The guidance recommends designing transparency requirements into the system architecture specifically to detect deception indicators. Worth bookmarking for your next board presentation on AI risk.

On structural risk, the document correctly identifies the cascading failure problem in multi-agent systems. One compromised agent can spread incorrect information, exploit trust and consensus mechanisms, or operate through hidden channels. Possible attack vectors include supply chain tampering, poisoned environments, and communication poisoning. The mitigation is isolation and segmentation: separate high-risk agents into distinct domains, and never let a single compromise propagate laterally across the full agent fleet.

On accountability, the guidance calls for “unified audit logs for all inter-agent interactions,” “interpretability tools to ensure observability of and reasoning behind agent decisions,” and “specific information referencing for agents that show where key aspects of their response originated from.” Every one of these requirements maps directly to what the Lineage Vault in our Unified Architecture is designed to provide: an append-only, cryptographically chained record of not just what agents did, but what they were authorized to do, what content they acted on, and whether that content was genuine.

The Gap the Guidance Doesn’t Fill

Here’s where the document runs out of runway.

The guidance is thorough on what you should do once you have an agent infrastructure. Authenticate agents. Scope their tokens. Monitor their behavior. Log everything. Great. But it doesn’t answer the harder question that sits one layer below all of that: how do you verify that the entity at the top of the delegation chain is actually a human, and not another agent?

This matters more than it might sound. The entire rationale for human oversight, the thing the guidance calls “not optional”, depends on being able to cryptographically establish that a real, living person authorized the action chain. Not a workflow approval in a ticketing system. Not an OAuth token delegated three hops ago. An actual, verifiable, hardware-rooted proof that a biological human was in the loop when it counted.

The guidance says to “ensure decisions about when human approval is required are determined by system designers or operators, not delegated to the agentic AI system.” That’s exactly right as a principle. But a principle without a mechanism is just a policy document. And policy documents, as we’ve established, are not the same as prerequisites.

The mechanism is what we’ve been describing as the Pulse Protocol. The idea is straightforward: for high-stakes actions, human authorization is captured not as a click in a workflow but as a cryptographic Proof of Intent, produced at the hardware level, signed by a biometrically confirmed liveness event, and embedded in the provenance chain of every action the agent takes downstream. A workflow approval can be spoofed. A PoI signature anchored to a Secure Enclave cannot.

Without something like this, “human oversight” is a checkbox. With it, it’s an architectural guarantee.

Four Questions Every Deployment Should Be Able to Answer

The guidance is a good baseline. But the practical test for any agentic deployment isn’t compliance with a framework — it’s whether you can answer four questions under pressure:

Can you prove a human authorized this? Not “someone clicked approve.” A verifiable, timestamped, hardware-rooted record that a specific person authorized a specific action at a specific moment.

Did your agents only do what they were supposed to do? Least-privilege token scoping is the mechanism. If an agent authorized to summarize a document can also export your payroll data, the answer is no.

Can you trust the content your agents were acting on? This is the provenance question. Artifact stamping, lineage declarations, and watermark-based integrity verification are how you answer it. If your agents are acting on data with no provenance record, you have no way to know whether that data was manipulated before they touched it.

If something went wrong, can you reconstruct exactly what happened? Not a best-guess log correlation exercise. A causal reconstruction that traces every authorization decision, every policy evaluation, and every delegation hop back to the human who started the chain.

Most enterprises can’t answer all four. The Five Eyes guidance tells you why you need to. The architecture work we’ve been documenting in this series is one blueprint for how.

The One Thing to Do This Week

If you’re deploying agentic AI and you haven’t mapped your current agent inventory against the five risk categories in the CISA guidance, that’s the starting point. Not the technology. The audit.

You probably have agents with excessive privileges that were scoped broadly during a pilot and never tightened. You probably have agent-to-agent trust relationships that were never formally established. And you almost certainly have accountability gaps where the chain of authorization gets fuzzy fast.

The good news is that the guidance is another clear signal, along with the OWASP Top 10 for Agentic Applications, that the industry is converging on the right problems. The governance vacuum is officially acknowledged. The standards are being written. The architecture patterns are documented.

Your agents are going to have a rap sheet eventually. The question is whether you’re the one keeping it, or whether you’re going to find out about it from someone else.