What is Agentic AI?

Agentic AI refers to AI systems that can work towards a goal with a degree of independence. Rather than simply responding to a prompt, they can decide what steps to take next, use tools and carry out actions with less direct human involvement.

That marks a shift from the way most organisations have used AI up to now. Generative AI has largely been used to produce or analyse information. Agentic AI can go further by acting on that information and interacting with other systems, which creates new possibilities for automation but also raises different questions around control and oversight.

As these systems move from experimentation into real-world use, organisations need to understand not only what agentic AI can do, but what happens when it’s given the freedom to act. That’s where the security conversation starts to change.

What Makes Agentic AI Different

The difference is not intelligence, it is agency. A generative AI tool waits for a prompt and returns an answer. An agent is given a goal, then decides for itself which steps to take, which tools to call and which systems to touch along the way.

For organisations, that creates obvious opportunities. An AI agent might be asked to complete a broader task, then work across different systems to do it. Employees may spend less time handling each step themselves, but that also means giving AI much more freedom inside the business. The question is no longer just what the system can generate, but what it can access and what it can do once it has that access.

A recent Australian example shows why that matters. In late September, the Prime Minister confirmed that an OpenAI agent had accessed an Australian government website and non-public Medicare data. No patient records were believed to be involved, but OpenAI has since acknowledged the agent ran commands, retrieved credentials and wrote files. It was also around three months before the government was told. The agent did not just return information when prompted. It acted, reached further than intended and went unnoticed, which raises bigger questions about how much autonomy these systems should have, what they should be allowed to access and how quickly misuse would be detected.

That’s why agentic AI needs to be treated differently. Once a system can act rather than simply respond, it needs a different approach to security.

How Guidance is Adapting to Agentic AI

As organisations begin using agentic AI in practice, Australian guidance is starting to reflect the added risks of giving systems more autonomy. The Australian Signals Directorate and wider Australian Government guidance point to a few clear priorities:

• Adopt agentic AI carefully: Start with low-risk, clearly defined use cases, and avoid giving agents broad access to sensitive systems until you understand the controls around them.
• Put limits around what agents can do: Agentic AI harnesses can help control how models interact with organisational tools and data, including where human approval is still needed for higher-impact actions.
• Plan for ongoing oversight: The Australian Government’s agentic AI addendum places more emphasis on monitoring how agents behave over time and making sure their activity can be restricted or stopped when necessary.

What Organisations Need to Consider

As the changing guidance suggests, giving an AI agent greater freedom to act means organisations need to be clear about the boundaries around that role. Before deployment, a few questions can help explain where the biggest risks may sit:

• What is the AI system allowed to access? The wider its access, including the information it can retain and carry forward, the greater the potential impact if something goes wrong.
• What can it do without human approval? Some actions carry much more risk than others, particularly where an agent can change data, trigger transactions, call other tools or interact with external systems on its own.
• Who is accountable for its decisions and outcomes? Someone still needs to own the consequences if an agent makes a mistake or behaves unexpectedly.
• How will inappropriate or unexpected behaviour be identified? Organisations need enough visibility to understand when an agent has moved outside its intended role.
• How easily can its access be restricted, reviewed, or withdrawn? That becomes important if the system no longer needs the same level of access, or if concerns emerge about how it is behaving.

Treat Agents Like Users, and Watch Them Like Users

Most of those questions come back to two things: identity and visibility. Every agent acts through an identity, whether that is a service account, an API token or a delegated user session. Those non-human identities are fast becoming the real control point, and in most environments they are less governed and less monitored than the people they work alongside.

• Give every agent its own identity: Scope it to the task, make it read-only by default, and make sure it can be revoked quickly.
• Log what agents do, not just what they say: Record the tools called, data accessed and changes made, so actions can be traced and checked.
• Bring agent activity into security monitoring: The same detection and response that watches user behaviour should watch agent behaviour, so unusual access is spotted in minutes, not months.
• Find the agents you did not approve: Shadow AI is already in most organisations. You cannot govern agents you cannot see.

The principle is simple. AI can speed up the work, but people should still decide the outcomes that matter.

Building the Right Boundaries Around Agentic AI

Agentic AI can give organisations more freedom to automate complex work, but that freedom needs clear limits. The questions around access, approval and oversight are not there to slow adoption down. They’re what make it possible to use these systems with more confidence.

Taking a second before letting an agent act can help organisations understand where the real risk lies. That may mean looking again at what the system can reach, or deciding where human involvement still matters. The Australian Government’s wider AI security guidance reflects the same principle: security needs to be built in from the start and remain a constant part of how AI is used.

Infotrust’s Secure AI practice helps organisations put those boundaries in place, from agentic AI governance health checks and ISO/IEC 42001 readiness through to monitoring agent activity within our SOC. If you’d like support reviewing how agentic AI is being used in your environment, contact us to discuss the next steps.