Audience: AI platform engineers, DevSecOps teams deploying AI agents, critical infrastructure operators, defense contractors, CISOs, and compliance officers.
Status: Published April 30, 2026 by CISA and NSA, jointly with Australia, Canada, New Zealand, and United Kingdom. Advisory but carries near-mandatory weight for defense contractors and critical infrastructure operators. Five risk categories with specific technical mitigations.
Contents
1. Overview -- Five Risk Categories 2. Key Requirements 3. Procedure Mapping Table 4. Procedure Deep Dives 5. Quick Reference -- Examiner Questions 6. Quick Start 7. References1. Overview -- Five Risk Categories
The CISA/NSA joint guidance identifies five categories of risk specific to agentic AI systems. These risks apply to any environment where AI agents operate with autonomous decision-making authority, execute tool calls, or interact with other agents. Five Eyes endorsement makes this guidance the de facto standard for allied defense and critical infrastructure sectors.
Risk Categories
- Privilege Escalation -- agents gaining access beyond authorized scope through prompt injection, tool misuse, or credential leakage
- Design and Configuration Failures -- insecure defaults, missing authentication, excessive permissions, and unvalidated tool configurations
- Behavioral Misalignment -- agents deviating from intended behavior or objectives through drift, reward hacking, or adversarial manipulation
- Structural Brittleness -- single points of failure, cascading errors in multi-agent systems, and lack of graceful degradation
- Accountability Gaps -- inability to attribute actions to specific agents or operators, missing audit trails, and unverifiable decision chains
SWT3 witness procedures address all five categories by producing cryptographically anchored evidence at each decision point. The mapping below shows which procedures apply to each requirement and what evidence they produce.
2. Key Requirements
The guidance specifies the following technical requirements for organizations deploying agentic AI systems:
- Cryptographic agent identity -- each agent must carry a cryptographically anchored, unique identity with short-lived credentials
- Mutual TLS for inter-agent communications -- all agent-to-agent traffic must use mutual TLS with certificate validation
- Human approval gates -- explicit human approval required for high-impact actions with documented rationale
- Least-privilege scoping -- strict least-privilege scoping for all tool and API access with continuous enforcement
- Continuous behavioral monitoring -- ongoing monitoring for behavioral drift with automated alerting and containment
3. Procedure Mapping Table
Each CISA/NSA requirement maps to one or more SWT3 witness procedures. The witness anchor produced by each procedure constitutes independently verifiable evidence of compliance.
| CISA/NSA Requirement | SWT3 Procedure | What It Witnesses | Evidence Produced |
|---|---|---|---|
| Cryptographic agent identity | AI-ID.1 |
agent_id bound to every inference, identity persistence across sessions | SWT3 anchor with agent_id factor |
| Privilege escalation prevention | AI-ACC.1 |
Access scope, permission level, resource accessed | Access control anchor per resource interaction |
| Tool access least-privilege | AI-TOOL.1 |
Tool name, invocation context, authorization status | Tool invocation anchor per call |
| Behavioral misalignment detection | AI-DRIFT.1 |
Metrics evaluated, drift count, type | Drift detection anchor with threshold data |
| Guardrail enforcement | AI-GRD.1 |
Guardrail type, trigger status, bypass attempts | Guardrail verification anchor |
| Human approval gates | AI-HITL.1 |
Override decision, rationale, authority level | Human-in-the-loop decision anchor |
| Accountability chain | AI-INF.1 |
Model hash, prompt hash, response hash per inference | Inference provenance anchor |
| Audit trail integrity | AI-AUDIT.1 |
Entry count, tamper detection result | Audit integrity verification anchor |
| Inter-agent security | AI-SEC.1 |
Scan results, threats detected | Security posture anchor |
| Emergency containment | AI-EMRG.1 |
Emergency type, actions halted, recovery plan | Emergency lifecycle anchor |
| Multi-agent delegation | AI-DEL.1 |
Delegator, delegatee, scope, constraints | Delegation chain anchor |
4. Procedure Deep Dives
Cryptographic Agent Identity
CISA requires that each agent carry a cryptographically anchored unique identity with short-lived credentials. SWT3 addresses this by binding agent_id to every witness anchor minted during the agent's operation. The agent identity persists across sessions and is independently verifiable against the witness ledger.
The agent_id field is set at SDK initialization and propagated to every subsequent anchor. Combined with the authorization_id from pre-inference gates, this creates a dual-factor identity chain -- the agent proves both who it is and that it was authorized to act.
Verify that the agent_id field appears in every anchor minted by the agent. Cross-reference with the authorization_id from pre-inference gates to confirm dual-factor identity. Query the ledger for any anchors missing agent_id -- these indicate identity gaps.
Least-Privilege Access and Tool Witnessing
Privilege escalation is the number one risk identified in the guidance. SWT3's wrap_tool() and wrap_access() functions mint anchors recording every tool invocation and resource access with full authorization context. Each anchor captures what was accessed, at what permission level, and whether the access was authorized.
This creates an immutable record of every action the agent took, making it possible to detect and attribute privilege escalation after the fact -- and to prove it did not occur during normal operations.
Filter the ledger by AI-ACC.1 and AI-TOOL.1. Look for anchors where permission_level exceeds expected scope. Any tool invocation without a corresponding AI-TOOL.1 anchor indicates an unwrapped tool -- a compliance gap.
Behavioral Alignment Monitoring
Behavioral misalignment requires continuous monitoring to detect and respond to deviations. AI-DRIFT.1 witnesses statistical drift detection -- capturing the metrics evaluated, the number of deviations detected, and their type. AI-GRD.1 proves that safety guardrails are actively enforced by recording guardrail type, trigger status, and any bypass attempts.
Together, these procedures provide evidence that behavioral alignment is continuously monitored and that safety constraints are actively enforced -- not just configured.
AI-DRIFT.1 anchors with drift_detected > 0 should correlate with AI-GRD.1 anchors showing guardrail triggers in the same time window. If drift is detected but no guardrail fires, the safety architecture has a gap.
Human-in-the-Loop Gates
The guidance requires explicit human approval for high-impact actions. The AI-HITL.1 anchor records the decision (approve, deny, or escalate), the rationale provided by the human reviewer, and the authority level of the person making the decision.
This creates a verifiable chain showing that a qualified human was in the loop for every high-impact decision -- and that the agent did not proceed without authorization.
Verify AI-HITL.1 anchors exist before high-impact actions in the timeline. Check that authority_level matches the organizational authorization matrix. Escalation decisions should have a corresponding follow-up anchor showing resolution.
Containment and Emergency Override
Structural brittleness requires containment capabilities that can halt cascading failures across multi-agent systems. AI-EMRG.1 witnesses the full emergency lifecycle -- type of emergency, actions halted, and recovery plan. AI-SAFE.1 proves the system can transition to a safe state and confirms successful recovery.
These procedures address the structural brittleness risk by providing evidence that containment is not just possible but has been exercised and verified.
Verify AI-EMRG.1 anchors show all agents in the chain were halted during containment events. Cross-reference with AI-SAFE.1 anchors for recovery confirmation. The time gap between emergency and safe-state anchors indicates containment response time.
5. Quick Reference -- Examiner Questions
Common questions an examiner or auditor may ask when evaluating your agentic AI deployment against the CISA/NSA guidance:
| Question | Evidence Source |
|---|---|
| How do you uniquely identify each AI agent? | AI-ID.1 anchors -- show agent_id binding and persistence across sessions |
| How do you prevent agents from escalating privileges? | AI-ACC.1 + AI-TOOL.1 anchors -- show access scope and tool invocation authorization |
| How do you detect behavioral misalignment? | AI-DRIFT.1 anchors -- show continuous drift monitoring with metrics and thresholds |
| How do you enforce human oversight for high-impact decisions? | AI-HITL.1 anchors -- show decision, rationale, and authority level before action |
| Can you attribute any agent action to a specific operator? | AI-INF.1 + AI-ID.1 anchors -- full inference provenance with agent identity |
| How do you handle cascading failures in multi-agent systems? | AI-EMRG.1 + AI-SAFE.1 anchors -- emergency containment and safe-state recovery |
| How do you verify audit trail integrity? | AI-AUDIT.1 anchors -- tamper detection with entry counts and hash verification |
6. Quick Start
Get started with SWT3 witness procedures for agentic AI compliance in minutes.
Python
from swt3_ai import Witness
witness = Witness(
api_key="your-api-key",
tenant_id="your-tenant-id",
agent_id="agent-alpha-001", # AI-ID.1
profile="defense-govcon"
)
TypeScript
import { Witness } from '@tenova/swt3-ai';
const witness = new Witness({
apiKey: 'your-api-key',
tenantId: 'your-tenant-id',
agentId: 'agent-alpha-001', // AI-ID.1
profile: 'defense-govcon'
});
The defense-govcon profile automatically enables the procedures mapped in this crosswalk. See the SDK documentation for full configuration options.
7. References
- CISA: Careful Adoption of Agentic AI Services (April 30, 2026)
- NSA: Deploying AI Systems Securely -- Best Practices for Deploying Secure and Resilient AI Systems
- NSA MCP Security Mapping
- NIST Agentic AI Standards Crosswalk
- Multi-Agent Witness Guide
- AI Agent Audit Trail Guide
- Cryptographic AI Evidence Quickstart