The short answer
The September 2026 Information security manual requires that every AI agent has its own identity, that you keep a register of those agents, and that an agent can only reach the minimum set of tools it needs. Seven controls are new. One that already existed was made stricter.
The requirement most organisations fail immediately is the register. ISM-2135 asks which tools and data each agent can reach, and that answer lives in configuration rather than in a document someone can write.
Identify the agent and write it down
These three sit in the ISM chapter on system access. That placement is the clue: an agent is treated as something holding access, not as a feature of an application.
| Control | What the ISM says | What it means in practice |
|---|---|---|
ISM-2133 | Each AI agent is assigned a unique identity that is distinct from the user accounts of personnel and the identities of other AI agents. | An agent cannot run as a person, and two agents cannot share one identity. |
ISM-2134 | An AI agent register is developed, implemented, maintained and regularly verified. | The register has to exist, stay current, and be checked against reality. |
ISM-2135 | An AI agent register contains the following for each AI agent: its unique identifier; its owner and business purpose; the identities assigned to it; any user accounts and credentials it uses; and the tools, permissions and data repositories it can access. | Five fields per agent. The last one is the one nobody has. |
Giving each agent its own identity sounds administrative until you try it. Most deployments authenticate as the person who triggered them, or as one shared service account. Both are now the wrong answer.
Constrain what the agent can do
These four sit under excessive agency in the software development chapter, describing the failure mode where an agent can do far more than its purpose requires.
| Control | What the ISM says | What it means in practice |
|---|---|---|
ISM-2156 | Agentic AI applications are restricted to the minimum set of tools, functions and permissions required for their intended purpose. | Least privilege, applied to the tool list rather than to a role. |
ISM-2157 | Tools invoked by agentic AI applications are subject to both the access controls of the invoking user and agent-specific, task-scoped authorisation, with effective permissions limited to the minimum permitted by both. | The agent gets the intersection of its own scope and the user it acts for. |
ISM-2158 | External content retrieved by agentic AI applications is treated as untrusted data throughout processing, is clearly delimited from system instructions, is subject to validation and sanitisation measures applied to other untrusted input, remains untrusted following such processing, and is prevented from modifying or overriding system instructions, security policies, access controls, tool permissions or human approval requirements. | Retrieved content stays untrusted even after sanitisation, and can never change the rules. |
ISM-2159 | All tool invocations, external requests and outputs generated by agentic AI applications are centrally logged with sufficient detail to support cyber security incident investigations. | Tool calls and outputs, centrally, at a detail level an investigation can use. |
ISM-2157 is the demanding one. The agent gets the intersection of its own task-scoped authorisation and the permissions of the user it acts for. An agent inheriting an administrator's rights because an administrator asked it a question does not satisfy this.
ISM-2158 catches retrieval systems. External content stays untrusted even after sanitisation, and can never override system instructions or approval requirements.
The control that got stricter
| Control | What the ISM says | What it means in practice |
|---|---|---|
ISM-2113 | AI applications are configured to require human approval before executing sensitive or high-impact actions. | Approval is now required for sensitive actions, not just flagged for a human to notice. |
The earlier wording asked that risky actions be flagged for approval. It now requires approval before a sensitive action executes. Flagging is something you add to a log. Requiring approval is something you have to build.
Why the Essential Eight does not help here
All eight are published with no Essential Eight mapping, and so are the other 36 controls added in this release.
- Essential Eight Maturity Level Three does not address any of the eight.
- Posture tools reporting against the Essential Eight will not see this.
- An agent register is not a control any product ships with.
- The gap is in what you know, not in what you have bought.
Where to start
Build the register first, because every other control depends on knowing what exists. Start with the field nobody has: the tools and data each agent can reach today.
That list is usually longer than expected, and shortening it is ISM-2156 and ISM-2157 in one piece of work. An agent security review produces that inventory. The Essential Eight assessment page sets out what that obligation covers, and this sits outside it. The rest is in the guides index.
The source
All eight controls above were read from the Information security manual, September 2026 release, published by the Australian Signals Directorate. Verified on 18 September 2026. The changes document for the same release states which controls were introduced and which were amended.