Security1 publisher2 min readPublished
Australian Signals Directorate moves the agentic AI security boundary from model to harness
The Australian Signals Directorate has published guidance placing agentic AI's enforcement point in the harness, the software layer that decides which tool calls run and with what permissions. Its remedies are configuration and logging.
The Watch · Security desk
What happened
- The Australian Signals Directorate has published guidance on agentic AI harnesses, the software layer that connects a language model to organisational data, tools and systems.
- ASD says the harness determines what information an agent receives, which tools it can access, what actions it can perform and which controls are applied to it.
- The guidance says some risks, prompt injection among them, cannot be reliably addressed within the model, and require controls across the harness, connected systems and governance processes.
- It names five risk categories for agentic AI systems: privilege, design and configuration, behavioural, structural and accountability.
- ASD recommends treating a multi-agent system as a single agent for security purposes, because a compromise in one component may propagate through shared context and trust relationships.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Excessive privilege turns one compromised agent into far-reaching access, so the reach of an injection is set by what the harness's permission system already allows, not by how the model behaves.
- constraint Swapping models does not reset the security work. ASD expects the harness and its integrations to be the longer-term investment, and calls the harness the part an organisation can most directly govern, secure and control.
- decision ASD says no harness is inherently secure. Harness selection becomes a security review question, with documented capabilities, permissions and layered controls as the buying criteria.
Prompt injection lands through the harness. The model reads a poisoned document and emits a proposed action; the harness is what turns that proposal into a call. ASD's component list names the parts that do the turning: tool registry, permission system, execution environment and connector layer, alongside the user interface, policy layer, context manager, model interface, memory and session store, and audit and observability [5]. That is ten components, and each one is a place where a permission is enforced or an action is recorded [15]. ASD also flags structural risk, where failures cascade across interconnected components and workflows [8].
The controls in the guidance are the ordinary ones. Least-privilege access, identity and access management, secure design, monitoring and incident response, plus human oversight for high-impact actions, control over access to external data and tools, validation of agent outputs, audit logs and supply-chain assurance [11]. ASD wants deployment phased, starting with approved use cases, appropriate data classification and security validation before broader adoption [12]. The guidance puts insecure architecture and configuration in its own risk category, covering weaknesses introduced before anything is deployed [18]. All of that takes a record of which agent runs under which identity, against which tools.
There is no CVE in this document, no named incident and no compliance date [16]. What ASD supplies instead is a review checklist: five questions for executives and CISOs [17]. They cover what data and systems an agent can access, what actions require human approval, how AI-specific attacks are mitigated, whether significant actions can be monitored and audited, and what could happen if the harness were compromised or misconfigured [14]. The audit question maps to ASD's accountability risk category, where complex agentic systems make it difficult to trace decisions, audit actions or assign responsibility [9].
What to watch
- Whether ASD converts the harness guidance into mandatory controls for Australian government entities.
- Whether harness vendors publish permission and audit documentation mapped to ASD's ten-component list.
- The first publicly reported incident where the harness is named as the failure point.