ASD's New Agentic AI Guidance — What Australian Businesses Need to Know Before Deploying AI Agents

In May 2026, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), together with CISA, the NSA, and cybersecurity agencies from the UK, Canada, and New Zealand, published joint guidance on the careful adoption of agentic AI — outlining the security risks of autonomous AI systems and the controls Australian organisations must implement before deploying them. This guidance directly applies to businesses deploying Microsoft 365 Copilot, Power Automate, and AI automation workflows.

The joint publication — Careful Adoption of Agentic AI Services (1 May 2026) — is now the reference document Australian businesses should be working from when planning any AI agent deployment.

What is agentic AI and how is it different from Copilot?

Agentic AI systems are LLM-based autonomous agents that can reason, plan, and take actions independently — without continuous human intervention. Unlike Microsoft 365 Copilot in its default mode (which responds to prompts and drafts content for a human to review), agentic AI can initiate tasks, spawn sub-agents, call external tools, and execute multi-step workflows on its own.

Examples relevant to Australian businesses include Power Automate flows triggered by AI decisions, Microsoft Copilot Studio agents that interact with external systems, and any AI-powered workflow that can modify data, send emails, approve transactions, or access sensitive systems without a human in the loop.

The ASD guidance applies to all of these — and also to Microsoft 365 Copilot deployments where AI has been granted access to sensitive SharePoint libraries, financial records, or HR systems. The moment AI is acting on data at scale or taking real actions on your behalf, the agentic AI controls apply.

What are the key risks the ASD identified for Australian organisations?

The joint guidance groups the risks into five categories. In plain English:

• Privilege risks — AI agents granted excessive access can be exploited to reach data or systems far beyond their intended scope. The "confused deputy" attack — where a trusted agent is manipulated into performing actions a low-privileged user couldn't do directly — is specifically called out.
• Design and configuration risks — permissions evaluated only at startup (not per request) mean a stale "allow" decision can be exploited later. Poor segmentation between agents lets a single compromise pivot laterally across your environment.
• Behaviour risks — AI agents can pursue goals in unexpected ways, including disabling security controls to achieve their objectives (specification gaming), or behaving differently when under evaluation versus in production.
• Structural risks — interconnected agents create cascading failure risks where a single compromised component propagates across the entire system.
• Accountability risks — autonomous agent actions are difficult to trace and audit, creating compliance and governance gaps that will show up in cyber insurance reviews, Essential Eight assessments, and board reporting.

What does the ASD guidance recommend — the three most important controls for Australian businesses?

For Australian SMBs deploying Microsoft 365 Copilot and Power Automate, three controls from the guidance stand out:

• Least privilege — never grant AI agents broad or unrestricted access, especially to sensitive data or critical systems. For Copilot, this means SharePoint permissions must be correctly scoped before enabling AI — Copilot inherits every permission a user has. For Power Automate, service account permissions must be the minimum required for each individual flow.
• Human in the loop — high-impact or irreversible actions must require human approval. AI should not autonomously delete records, send external emails on behalf of executives, approve financial transactions, or modify access controls without a human review step in the workflow.
• Progressive deployment — start with low-risk, well-defined tasks and incrementally expand AI access and autonomy. The ASD explicitly recommends phased deployment with continuously increasing access — not enabling all features at once on day one.

Is your Microsoft 365 environment configured to meet the ASD's agentic AI security controls? Take our AI Readiness Assessment → and find out before you enable Copilot.

What does this mean for businesses deploying Microsoft 365 Copilot in Australia?

The ASD guidance confirms what Mycelium 365 has been advising Australian clients: governance first, always. Specifically, before Copilot is switched on:

• SharePoint permissions must be audited and tightened — overpermissioned SharePoint is the single most common Copilot deployment risk we see.
• Sensitivity labels must be configured in Microsoft Purview so Copilot respects data classifications when surfacing content.
• DLP policies must be active to prevent sensitive data being surfaced through AI prompts or exported via Copilot chat.
• MFA must be enforced for all users via Entra ID Conditional Access, with agent-accessible accounts under stricter policies.

The guidance also notes that organisations should "only use agentic AI for low-risk and non-sensitive tasks" during the early phases — which in practical terms means Copilot should be piloted with a limited group of users on non-sensitive content before any broader rollout. The AI Readiness Assessment is the practical starting point — it maps your current Microsoft 365 configuration against these controls and identifies the gaps.

The ASD's four-step framework for deploying agentic AI safely

The guidance is structured around four phases. Translated into practical steps for Australian businesses:

• Design securely — implement least privilege from day one, structure prompt context with a clear instruction hierarchy, and build in human oversight mechanisms before deployment rather than bolting them on after go-live.
• Develop securely — test AI behaviour adversarially before production, validate against real-world scenarios including misuse cases, and maintain a trusted registry of the third-party AI components, connectors, and tools your agents rely on.
• Deploy securely — use phased deployment starting with low-risk tasks, implement guardrails and "do not do" constraints, and isolate high-risk AI agents into separate domains with no write access to logs or audit trails.
• Operate securely — continuously monitor all agent actions (not just inputs and outputs), implement anomaly detection for unusual agent behaviour, require human approval for high-impact irreversible actions, and conduct regular red team exercises against your AI systems.

This is the same lifecycle that already applies to any other production system — it just now needs to be applied to AI agents with the same rigour.

Is your business ready to deploy agentic AI safely?

The ASD guidance makes clear that agentic AI deployment without appropriate security controls creates material cyber risk — not theoretical risk. For Australian businesses deploying Microsoft 365 Copilot or building Power Automate automation, the AI Readiness Assessment is the practical first step — it reviews your Microsoft 365 environment, permissions, security posture, and governance framework against the controls the ASD now recommends. If you need help translating the ASD framework into a phased Copilot and automation roadmap, our AI Strategy Advisory service is designed for exactly that.

Related reading: What is AI readiness? · AI readiness audit vs assessment · Where to start with Power Automate · Managed Security Operations Centre.