ASD first published its Agentic AI harnesses guidance on 11 September 2026 for executives, CISOs and IT leaders. It separates the large language model from the harness that supplies context and memory, exposes tools and data, enforces permissions, runs actions and records evidence. That distinction gives organisations a governable target even as models change.
What happened: ASD defined the organisation's control surface
ASD describes the harness as every component of an agentic system other than the LLM: the user interface, policy layer, context manager, model interface, tool registry, permission system, execution environment, connectors, memory, observability and update path. The model proposes; the harness decides what information is supplied and whether an action can actually occur.
The guidance argues that many high-impact risks emerge when a model is connected to enterprise systems. Prompt injection, poisoned data, excessive privilege, unsafe tool use, persistent manipulated memory and opaque multi-step failures cannot be solved reliably by model behaviour or prompt wording alone. Controls must also exist in the harness, connected systems and organisational processes.
ASD recommends phased adoption beginning with low-risk use cases, along with least privilege, strong identity controls, hardened execution, validation, human approval for sensitive actions, protected logs, cost monitoring, supply-chain assurance and integration with incident response.
Why it matters: model choice is only one part of the risk decision
Procurement discussions often centre on model capability, safety claims and price. ASD's framing redirects assurance work to the parts an organisation can configure and retain: which connectors exist, what each identity can reach, what actions require approval, where code runs, what memory persists and whether an investigator can reconstruct an outcome.
This also changes accountability. A person remains responsible for accepting operational output even when the harness drafted it, tested it or performed an action. For multi-agent systems, ASD advises treating the whole arrangement as one agent for security purposes because compromise can propagate through shared context and trust relationships.
Cost controls become a security signal as well as a finance control. Unexpected token, API or compute consumption can reveal runaway loops, misuse, compromise or denial-of-wallet activity. Spend, latency, permission denials and tool failures therefore belong beside conventional security events in monitoring and incident playbooks.
The practical implication: build a harness assurance register
For every deployed agent, record the business owner, approved use case, model, harness version, service identity, accessible data, enabled tools, network destinations, persistent memory, approval gates, execution boundary, spend limit, logs, retention period and incident-response path. Review that register whenever a connector, tool, model or policy changes.
Test controls at the action boundary. Attempt prompt injection through realistic documents, emails, web pages and code comments; verify that the agent cannot cross data or tool permissions; confirm sensitive actions stop for approval; and prove that logs link the input, model output, tool invocation, approver and final result. Include loss of context, stale memory, repeated retries and unavailable dependencies in the exercises.
Start with a narrow workflow whose failure is reversible. Require independent acceptance criteria and a named human owner, then expand permissions only when evidence shows the controls work. Treat a model upgrade as a governed component change, but treat the harness as production infrastructure with versioning, secure defaults, rollback and ongoing assurance.
Key takeaways
Inventory the harness: tools, connectors, identities, memory, execution, approvals, logs and update path.
Enforce controls at the action boundary and test them with hostile content, failures and runaway-loop scenarios.
Begin with reversible, low-risk work and expand only when monitoring and control evidence supports it.
Sources
This article is original analysis written by IT Web Builder. The reporting and product details below were used as references and are credited to their publishers.
Australian Signals Directorate — Agentic AI harnessesFirst published 11 September 2026. Primary Australian Government guidance on the harness as the security, governance and operational control layer around an LLM.↗IT Web Builder publishes original summaries and practical commentary. We do not reproduce source articles. Product claims and announcements are linked to their original publishers so readers can verify the details.