Lessons from the front line.

On 20 August 2026, the National Cyber Security Centre published interim practical advice on managing the cyber risks of agentic AI, ahead of formal guidance that will supersede it.

These systems do not simply provide an answer. They can access information, make decisions and carry out tasks, with varying levels of human involvement.

This could help businesses automate repetitive work, but it changes the risk. With a conventional AI tool, a person will usually review the response before anything happens. An agent may be able to act immediately and repeat that action across several systems.

When one mistake becomes many

Imagine a business connects an AI agent to its finance system to support supplier payments. The agent encounters an unfamiliar billing code and interprets its instructions incorrectly. An employee might make one mistake and notice it. An agent could repeat the action across multiple payments before anyone realises.

The issue is not simply whether an agent makes a mistake, but how far that mistake can travel before it is detected and stopped.

The greater the agent’s access and freedom to act, the greater the potential impact.

The NCSC’s advice identifies seven practical considerations:

1. Work out what could go wrong before deployment.
2. Give the agent clear instructions and boundaries.
3. Decide which actions need human oversight or approval.
4. Limit the systems, information and services it can reach.
5. Record and monitor its activity.
6. Make its activity easy to identify and attribute.
7. Ensure it can be stopped immediately if something goes wrong.

At Amana, we translate these considerations into three connected areas that reflect how organisations make decisions: governance, cyber security and change management.

Governance: decide who is responsible

An agent can carry out a task, but it cannot be accountable for the result. For anything higher-risk, a named person or group must remain responsible for what it can do, who monitors it and what happens when something goes wrong.

Document the agent’s purpose in plain language, including the actions it may take and the boundaries it must never cross. Decide which actions need approval before they happen, which can be monitored as they happen and which low-risk tasks can be completed without review. The choice should reflect the possible consequences, not simply what is most convenient.

Cyber security: limit what the agent can reach

Give each agent its own identity rather than allowing it to use an employee’s account. This makes its actions easier to track and its access easier to control.

Only give it access to the information and systems required for its task. Block connections it does not need and avoid giving it permanent access. Prompts and built-in safeguards may help guide behaviour, but the surrounding systems must still limit what the agent can actually do.

Keep a reliable record of its activity and use alerts to identify unusual behaviour. A named person should be able to stop the agent and remove its access immediately.

Change management: prepare the organisation

Staff need to understand what the agent does, what they remain responsible for and how to raise a concern. Otherwise, people may assume somebody else is checking its work.

Businesses should also ask suppliers what their product can access, how actions are recorded, whether important decisions can require approval and how quickly access can be removed. Begin with a low-risk task that is easy to monitor, then increase responsibility only when there is evidence that the controls work in practice.

Four questions to ask before deployment

Smaller organisations do not necessarily need a new governance function. They do need clear answers to four questions:

1. Who owns the decision to deploy the agent?
2. Who is monitoring what it does?
3. What must it never be allowed to do?
4. How quickly can it be stopped?

If those answers are unclear, the business is not ready to give the agent greater autonomy.

Source: National Cyber Security Centre, “Managing the cyber risk of agentic AI”, published 20 August 2026. The NCSC describes this as interim practical advice, to be superseded by formal guidance.