ASD ISM 2156 Restrict agentic AI applications to minimum tools, functions and permissions
What it says
Agentic AI applications are restricted to the minimum set of tools, functions and permissions required for their intended purpose.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGive each agentic AI application only the tools, functions and permissions its intended purpose actually needs, so it cannot act beyond its job if it is misled or misbehaves.
Agentic AI applications do not just answer questions. They can call tools, run functions and act on systems on their own, such as sending email, reading files, querying databases, running code or calling other services. This control says every agentic AI application must be limited to the minimum set of tools, functions and permissions it needs for its intended purpose, and nothing more. Why it matters: an agent decides what to do based on the instructions and content it processes, and that content can be manipulated (for example through prompt injection in a document or web page) or simply misunderstood. If the agent has been handed a broad toolkit and wide-ranging access "just in case", then a bad decision or a hostile input can turn into real actions: deleting data, exfiltrating files, changing configuration or spending money. Keeping the tools, functions and permissions tightly scoped to the purpose means that even when the agent goes wrong, the damage it can do is bounded by what it was allowed to touch.
Free. Save your status, tasks and notes.
Why it matters
If agentic AI applications are not restricted to the minimum tools, functions and permissions, a manipulated or malfunctioning agent can take actions well outside its intended purpose. This can lead to unauthorised access to or disclosure of sensitive information, destructive changes to systems and data, misuse of connected services, financial loss and a much larger blast radius from prompt injection or compromised inputs. It also makes incidents harder to contain and explain, because the agent's potential reach is wider than anyone planned for.
How to implement
AI application owners document the intended purpose of each agentic AI application in one or two sentences, then list only the tools, functions and permissions that purpose requires, before the agent is built or connected to anything.
Developers configure each agent with an explicit allow-list of tools and functions in the agent framework or platform, rather than exposing every available tool or integration by default.
Identity and access administrators issue each agentic AI application its own dedicated identity (service account, API key or token) with permissions scoped to the documented need, such as read-only access, specific data sets or specific API operations, instead of reusing a broad shared credential.
System owners route any request to add a new tool, function or permission to an agent through the normal change process, requiring a stated link to the agent's intended purpose before approval and configuration.
AI application owners and access administrators review each agent's configured tools, functions and permissions on a set schedule and whenever the agent's purpose changes, removing anything no longer required.
Keep it running
Day to day, this control lives in how agentic AI applications are designed, configured and changed. Each agent should have a written statement of its intended purpose, and its registered tools, exposed functions and granted permissions (API scopes, service accounts, file and data access, network reach) should be traceable back to that purpose. Anything not justified by the purpose should not be wired in.
Treat additions of tools, functions or permissions to an agent as a change that needs review and approval, not a quick configuration tweak. When an agent's purpose narrows or a feature is retired, remove the corresponding access rather than leaving it in place. Where a platform offers allow-lists for tools or scoped credentials per agent, use those rather than sharing a broad credential across many agents. Periodically compare what each agent can actually do (from platform configuration and identity systems) against what it is documented to need, and strip out the excess.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the inventory of agentic AI applications in use, with the documented intended purpose of each one.
Look at
Check that every agent in the inventory has a clear, specific purpose statement rather than a vague description like general assistant.
Good evidence
Each agent has a concise purpose that can be used to judge whether a given tool, function or permission is actually needed.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the configured tool and function list for a sample of agents, taken from the agent platform or code rather than from a policy document.
Look at
Compare the tools and functions actually enabled against the documented purpose and look for anything that does not serve it.
Good evidence
Only tools and functions that clearly support the stated purpose are enabled, and there is no default exposure of every available integration.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the identity and permission details (service accounts, API scopes, data and system access) assigned to the sampled agents.
Look at
Check whether each agent has its own scoped identity and whether the granted permissions match the minimum needed, for example read-only where the agent only needs to read.
Good evidence
Each agent runs under a dedicated identity with permissions narrowed to the documented need, with no shared broad credentials.
- Check 4 of 5What an auditor asks for
Ask for
Ask for change records where tools, functions or permissions were added to an agentic AI application.
Look at
Look for a stated justification tied to the agent's purpose and evidence of approval before the change was made.
Good evidence
Additions are approved through a change process with a recorded reason linked to the intended purpose, not made informally.
- Check 5 of 5What an auditor asks for
Ask for
Ask for evidence of periodic reviews of agent tools, functions and permissions, and of removals made as a result.
Look at
Check the review dates, what was compared, and whether unnecessary access was actually removed rather than just noted.
Good evidence
Reviews happen on a defined schedule and on purpose changes, and they result in excess tools, functions or permissions being removed.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-2156 requires agentic AI applications to be restricted to the minimum tools, functions and permissions necessary for their intended purpose. Annex A 5.15 requires the organisation to establish and implement access control policies and procedures governing logical and physical access based on business and security requirements. Annex A 5.15 is broader because it applies to all assets and access scenarios, whereas ISM-2156 is a specific least-privilege constraint for agentic AI tooling and permissions.
This control partially meets A.5.18.
ISM-2156 requires agentic AI applications to have only the minimum tools, functions and permissions necessary for their purpose. Annex A 5.18 governs the provisioning, review, modification and removal of access rights to information and assets, which is the broader access-rights lifecycle process enforcing least-privilege for all identities, including AI agent identities.
This control partially meets A.8.3.
ISM-2156 requires restricting agentic AI applications to the minimum tools, functions and permissions necessary. Annex A 8.3 requires access to information and associated assets to be restricted according to the organisation's access control policy, which covers least-privilege restrictions for all actors and systems. Annex A 8.3 is broader and policy-driven, whereas ISM-2156 is a specific access restriction pattern for agentic AI.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-RA-ML1.4.
ISM-2156 requires agentic AI applications to be restricted to the minimum tools, functions and permissions for their intended purpose. E8-RA-ML1.4 requires privileged accounts' access to online services to be explicitly authorised and limited to necessary duties. This aligns with least-privilege constraints applied to AI agent service accounts or operator privileged accounts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.