Overseeing many AI agents

Some organisations run several AI agents at once. Each one may send messages, change records or spend money. Someone has to keep all of them in view. Public guidance from UK government and security bodies describes what that person needs.

Know what is running

The government's AI Cyber Security Code of Practice was published on 31 January 2025. Its provision 5.1 says organisations "shall maintain a comprehensive inventory of their assets (including their interdependencies/connectivity)". For a group of agents, that means a list of each agent, what it can reach and who is responsible for it.

Limit what each agent may do

The Open Worldwide Application Security Project (OWASP) runs a Gen AI Security Project, which calls the risk of an agent doing more than it should "Excessive Agency". It notes that a system built on a large language model "is often granted a degree of agency by its developer". OWASP suggests limiting each agent's tools and permissions to the minimum it needs. Its own example is a tool that summarises email, which may only need to read messages.

Keep a record of every action

Provision 12.1 of the Code says "System Operators shall log system and user actions to support security compliance, incident investigations, and vulnerability remediation." The National Cyber Security Centre's guidelines for secure AI system development cover a system once it is deployed, "including logging and monitoring, update management and information sharing".

The OpenTelemetry project publishes shared conventions for recording generative AI calls.

Cap the spend

OWASP lists "Unbounded Consumption" as a risk. It advises applying "rate limiting and user quotas to restrict the number of requests a single source entity can make in a given time period." A team can ask whether each agent has its own limit, and whether the whole group has one too.

A person approves the risky steps

The government's AI Playbook is written for civil servants. Its Principle 4 reads "You have meaningful human control at the right stages". OWASP suggests requiring "a human to approve high-impact actions before they are taken". The useful question is which of each agent's actions need a person's sign-off.

A way to undo it

Things will sometimes go wrong. The Code's provision 6.5 says organisations "shall create, test and maintain an AI system incident management plan and an AI system recovery plan." Provision 5.3.1 adds that they "should ensure that a known good state can be restored."

The Playbook says "You should ensure that the release can be withdrawn and the system reverted to an earlier version if required." So each agent's setup needs a record of its last good version, and a tested way back to it.

Useful links