What does ASD ISM 2156 require?

policyASD Information Security Manual (ISM)

ASD ISM 2156Restrict Agentic AI Applications to Minimum Tools, Functions and Permissions

Give each agentic AI application only the tools, functions and permissions its intended purpose actually needs, so it cannot act beyond its job if it is misled or misbehaves.

Preventative NC OS P Artificial intelligenceASD Information Security ManualGuidelines for software development access control least privilege

record_voice_over

Plain language

Agentic AI applications do not just answer questions. They can call tools, run functions and act on systems on their own, such as sending email, reading files, querying databases, running code or calling other services. This control says every agentic AI application must be limited to the minimum set of tools, functions and permissions it needs for its intended purpose, and nothing more. Why it matters: an agent decides what to do based on the instructions and content it processes, and that content can be manipulated (for example through prompt injection in a document or web page) or simply misunderstood. If the agent has been handed a broad toolkit and wide-ranging access "just in case", then a bad decision or a hostile input can turn into real actions: deleting data, exfiltrating files, changing configuration or spending money. Keeping the tools, functions and permissions tightly scoped to the purpose means that even when the agent goes wrong, the damage it can do is bounded by what it was allowed to touch.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Sept 2026

Control Stack last updated

05 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for software development

Section

Artificial intelligence application development

Topic

Excessive agency

Official control statement

Agentic AI applications are restricted to the minimum set of tools, functions and permissions required for their intended purpose.

policyASD Information Security Manual (ISM)ISM-2156

priority_high

Why it matters

If agentic AI applications are not restricted to the minimum tools, functions and permissions, a manipulated or malfunctioning agent can take actions well outside its intended purpose. This can lead to unauthorised access to or disclosure of sensitive information, destructive changes to systems and data, misuse of connected services, financial loss and a much larger blast radius from prompt injection or compromised inputs. It also makes incidents harder to contain and explain, because the agent's potential reach is wider than anyone planned for.

settings

Operational notes

Day to day, this control lives in how agentic AI applications are designed, configured and changed. Each agent should have a written statement of its intended purpose, and its registered tools, exposed functions and granted permissions (API scopes, service accounts, file and data access, network reach) should be traceable back to that purpose. Anything not justified by the purpose should not be wired in.

Treat additions of tools, functions or permissions to an agent as a change that needs review and approval, not a quick configuration tweak. When an agent's purpose narrows or a feature is retired, remove the corresponding access rather than leaving it in place. Where a platform offers allow-lists for tools or scoped credentials per agent, use those rather than sharing a broad credential across many agents. Periodically compare what each agent can actually do (from platform configuration and identity systems) against what it is documented to need, and strip out the excess.

02 - Implement

build

Implementation tips

AI application owners document the intended purpose of each agentic AI application in one or two sentences, then list only the tools, functions and permissions that purpose requires, before the agent is built or connected to anything.
Developers configure each agent with an explicit allow-list of tools and functions in the agent framework or platform, rather than exposing every available tool or integration by default.
Identity and access administrators issue each agentic AI application its own dedicated identity (service account, API key or token) with permissions scoped to the documented need, such as read-only access, specific data sets or specific API operations, instead of reusing a broad shared credential.
System owners route any request to add a new tool, function or permission to an agent through the normal change process, requiring a stated link to the agent's intended purpose before approval and configuration.
AI application owners and access administrators review each agent's configured tools, functions and permissions on a set schedule and whenever the agent's purpose changes, removing anything no longer required.

03 - Audit

fact_check

Audit / evidence tips

AskAsk for the inventory of agentic AI applications in use, with the documented intended purpose of each one.Look atCheck that every agent in the inventory has a clear, specific purpose statement rather than a vague description like general assistant.GoodEach agent has a concise purpose that can be used to judge whether a given tool, function or permission is actually needed.
AskAsk for the configured tool and function list for a sample of agents, taken from the agent platform or code rather than from a policy document.Look atCompare the tools and functions actually enabled against the documented purpose and look for anything that does not serve it.GoodOnly tools and functions that clearly support the stated purpose are enabled, and there is no default exposure of every available integration.
AskAsk for the identity and permission details (service accounts, API scopes, data and system access) assigned to the sampled agents.Look atCheck whether each agent has its own scoped identity and whether the granted permissions match the minimum needed, for example read-only where the agent only needs to read.GoodEach agent runs under a dedicated identity with permissions narrowed to the documented need, with no shared broad credentials.
AskAsk for change records where tools, functions or permissions were added to an agentic AI application.Look atLook for a stated justification tied to the agent's purpose and evidence of approval before the change was made.GoodAdditions are approved through a change process with a recorded reason linked to the intended purpose, not made informally.
AskAsk for evidence of periodic reviews of agent tools, functions and permissions, and of removals made as a result.Look atCheck the review dates, what was compared, and whether unnecessary access was actually removed rather than just noted.GoodReviews happen on a defined schedule and on purpose changes, and they result in excess tools, functions or permissions being removed.

04 - Mappings

link

Cross-framework mappings

How ISM-2156 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(3)expand_less
Annex A 5.15	ISM-2156 requires agentic AI applications to be restricted to the minimum tools, functions and permissions necessary for their intended p...
Annex A 5.18	ISM-2156 requires agentic AI applications to have only the minimum tools, functions and permissions necessary for their purpose
Annex A 8.3	ISM-2156 requires restricting agentic AI applications to the minimum tools, functions and permissions necessary
handshakeSupports(2)expand_less
Annex A 5.16	ISM-2156 requires agentic AI applications to operate with only the minimum required permissions, typically relying on correctly managed i...
Annex A 8.22	ISM-2156 requires restricting agentic AI applications to only the minimum tools, functions and permissions required, often including cons...

E8

Control	Notes	Details
sync_altPartially overlaps(2)expand_less
E8-RM-ML1.1	ISM-2156 requires agentic AI applications to have only the minimum tools, functions and permissions needed, reducing the impact if the ag...
E8-RA-ML1.4	ISM-2156 requires agentic AI applications to be restricted to the minimum tools, functions and permissions for their intended purpose
handshakeSupports(1)expand_less
E8-RA-ML3.3	ISM-2156 requires agentic AI applications to be constrained to the minimum permissions needed for their purpose