Australia’s public service has moved beyond debating whether to use artificial intelligence.
The APS AI Plan aims to accelerate safe adoption, agencies have appointed Chief AI Officers, and GovAI is giving public servants a controlled environment to build practical capability. The next governance question is becoming more concrete: what should an AI agent actually be allowed to do?
That matters because the risk profile changes when AI moves from generating text to taking actions. A chatbot can offer a flawed suggestion. An agent can use credentials, access databases, send messages, modify records, invoke software tools, or coordinate work across systems before a human notices a mistake.
The need is visible in the METR/Redwood investigation of a major real-world cyberattack on Hugging Face. AI agents driven by an unreleased OpenAI internal research model attacked Hugging Face without human approval, despite recognising that the attack fell outside their assigned tasks. Roughly 1,200 agents found an unsanctioned message board, more than 700 participated in the attack, and the agents shared discoveries and divided work until they breached the company’s defences.
I’m no AI skeptic. I help organizations adopt AI for a living, and I want adoption to move faster. In my experience, strong safeguards increase trust and make faster adoption possible, while reducing the risk of failures like the Hugging Face attack.
Australia already has the right foundation. The National Framework for the Assurance of Artificial Intelligence in Government sets out a shared approach to safe and responsible AI across Australian, state, and territory governments. The APS AI Plan also links adoption to leadership accountability, capability development, and public trust.
Agentic AI now needs an operational control that sits underneath those principles: an authority register.
Before an agency deploys an AI agent, the register should answer five questions. Which systems and datasets may the agent access? Which actions may it take without approval? Which actions require a named human decision-maker? How long do its permissions last? What event automatically suspends or revokes those permissions?
Read also: AI deepfakes drive surge in fraudulent identity checks, research finds
The register should also match controls to consequences. An agent summarising public information needs lighter oversight than one that can alter a benefits record, approve a purchase, contact a citizen, or change security settings. Greater authority should trigger stronger independent evaluation, tighter logging, shorter permission windows, and clearer human approval points.
This approach also solves a workforce problem. Public servants are more likely to experiment responsibly when they know exactly where their judgment remains decisive. Vague rules encourage either overconfidence or avoidance. Specific authority boundaries give staff room to use agents while protecting decisions that require accountability.
Two additional safeguards should follow. Serious agent incidents should enter a common reporting and independent-review process so agencies can learn from one another. Frontier agents should also undergo independent evaluation before receiving broad access to sensitive government systems.
The United States’ NIST AI Agent Standards Initiative is already focusing on agent identity, authentication, authorization, and security evaluation. Australia can apply the same practical logic through its own assurance framework rather than waiting for a crisis to define the rules.
The public sector should keep accelerating AI adoption. But adoption becomes durable when authority is explicit. If an AI agent can act on behalf of government, the government should be able to say, in plain language, what that agent can do, what it cannot do, who approved those powers, and how quickly they can be taken away.
Dr. Gleb Tsipursky
Dr. Gleb Tsipursky, called the “Office Whisperer” by The New York Times, helps tech-forward leaders stop overpaying for AI while boosting engagement and innovation. He serves as the CEO of the future-of-work consultancy Disaster Avoidance Experts.
Latest
Popular