France’s national cybersecurity agency, ANSSI, has published seven security principles for organizations deploying AI agents, recommending controls that agents cannot override, human approval for critical actions, and mechanisms to stop abnormal activity.
Published on October 30, the English-language guide, Securing an Agentic AI System, addresses organizations deploying, configuring, or integrating agentic systems, including commercial products whose settings and connectors they control.
The publication is part of ANSSI’s Back to Basics collection, which primarily serves cybersecurity professionals, including security leaders and architects. It presents technical recommendations rather than a new regulatory obligation or product certification.
Seven Principles for Controlling Agent Activity
The two-page guide organizes its recommendations around seven areas:
- Assess risks throughout the system: Start during design and update the assessment after changes.
- Limit autonomy: Document the mission and expand capabilities gradually.
- Classify actions: Separate autonomous execution, mandatory human approval, and prohibited activity.
- Isolate environments: Separate development, evaluation, and production identities, connectors, and memory.
- Enforce authorization independently: Check permissions and business rules outside the model, denying actions by default.
- Contain operational impact: Protect secrets, limit agent interactions, and provide emergency shutdown and recovery mechanisms.
- Maintain demonstrable control: Test, monitor, inventory components, and protect activity logs.
Why Individual Permissions Are Not Enough
ANSSI also recommends checking whether a sequence of individually authorized actions could produce a prohibited outcome. Human approvers should see the exact proposed action, its purpose, and expected effects.
For enterprise application teams, this raises a practical design question: how should permissions work across an entire business process? In a hypothetical procurement workflow, creating a supplier record, changing payment details, and preparing a payment could each be permitted activities. Their combination deserves separate scrutiny, particularly where the organization relies on separation of duties.
The three action categories offer a useful starting point for project specifications and acceptance testing. Teams could map proposed finance, purchasing, or HR activities to those categories, then test whether connectors and application permissions enforce the intended boundaries.
Recovery behavior also matters. ANSSI recommends preventing recovered systems from repeating actions that have already produced an external effect. In a payment workflow, for example, that means checking transaction status before retrying an interrupted task.
Sources
ERP News Editorial Team
The ERPNews Editorial Team covers global developments in ERP (Enterprise Resource Planning), enterprise software, cloud platforms, AI, automation, and digital transformation, providing independent news and editorial analysis for senior business and technology leaders. Our reporting focuses on market signals, strategic shifts, and enterprise impact across the ERP and enterprise technology ecosystem.
For editorial inquiries, please contact:
📩 [email protected]
