The UK’s National Cyber Security Centre published interim guidance on August 20 telling organizations to stop treating AI agents like software features and start treating them like a new class of identity that needs its own access controls. Written by Toby W, Principal Security Architect at NCSC, the guidance follows what the agency describes as a run of incidents involving AI models carrying out unsanctioned or unintended actions. Its core recommendation is that every agent get a distinct identity separate from any human user, with credentials scoped to only what that specific task requires and, where possible, short-lived rather than standing. For higher-risk deployments, NCSC recommends running agents inside sandboxes with default-deny network access, allowlisting only the specific connections a task needs rather than granting general internet reach.
Why it matters for identity and access teams is that most enterprise IAM was built around the assumption that the entity requesting access is a human or a fixed service account, not something that can generate novel requests, chain tool calls, and act autonomously across systems, the same gap this publication’s AI agents identity problem opinion argued enterprises are still pretending does not exist.
The original insight is in NCSC’s network control tiering, which runs from Level 1, unrestricted access, to Level 4, no external access at all with a locally hosted model, a scale most organizations have no equivalent maturity model for today. That absence is measurable: Wiz’s security team recently found that an AI agent it built to hunt for cloud flaws surfaced a Snowflake configuration issue a code-review copilot had missed, evidence that agents are already operating with enough access to find serious flaws, which cuts both ways once that same access sits ungoverned. NCSC says formal guidance is still being developed and will eventually supersede this interim post.
Source: National Cyber Security Centre
