CERT-In's AI Security Auditing Guidelines, dated 4 November, say agents must not inherit permissions, must pause for human approval before consequential actions, must be logged and must be interruptible. I made the same three demands in March. This post does not celebrate; it turns the guidelines into four things an auditor can actually ask for — a per-agent permission ledger, an Agent Passport with a named human owner and a tested kill-switch, mandatory prompt-injection red-teaming, and a public register of AI-agent incidents — and says why the six-hour reporting clock stays unenforceable without them.
The Times of India reported this morning (6 November 2026) that CERT-In's AI Security Auditing Guidelines, dated 4 November, state that agents "shall not automatically inherit permissions from users, tools or other agents", and that "consequential actions shall use appropriate human approval gates". The same document asks for records of what agents do, emergency interruption for high-risk deployments, and tests of whether those approval gates can be bypassed.
In "When AI Gets Keys" (24 March 2026) I closed by asking for policy frameworks that would "define clear liability when an agent causes harm", "mandate minimum containment standards for any agent deployed with real-world privileges", and "require auditability and evidence-preserving logs that survive legal and regulatory scrutiny". Clause for clause, that is now sitting in an Indian government document. I claim no credit for it. I do claim the chance to say what is still missing.
Because a principle is not a form. My respectful suggestion to Shri Ashwini Vaishnaw and the Director General of CERT-In is that the guidelines be read as four artefacts an auditor can demand, and an enterprise can be failed for not producing:
- A per-agent permission ledger: one row for every agent in production, every system it can reach, who granted that reach, and the date it lapses. No inherited keys, ever.
- An Agent Passport, in the spirit of the pre-deployment certificate I argued for in "A hint of Intention?" (2 March 2024): declared scope, blast radius, a kill-switch with a tested date, and a named human owner who is a person, not "the IT team".
- A red-team clause for prompt injection, written into every audit: try to talk the approval gate open, since the Agents of Chaos experiments showed that ordinary wording was often enough.
- A register of AI-agent incidents, not only a duty to report them — anonymised and aggregated, so the second lender learns what the first one already paid to find out.
The six-hour clock is the sharpest thing in the file. CatchTheBrief reported on 5 November that an agent misusing credentials or acting beyond scope is a reportable incident under CERT-In's existing 2022 directions, and that few organisations keep complete, structured records of agent tool calls. You cannot report at six hours what you never logged.
None of this is hypothetical. CERT-In's own advisory, CIAD-2026-0058, issued 4 November, names an AI-assisted actor it calls CRAFTY FALCON, re-targeting Indian financial firms after incomplete remediation and timing attacks for weekends, as The Register reported on 6 November. The offence is already automated. The defence is still a PDF.
I may be over-engineering. A startup running its first agent will find the passport heavy, and I would let a small firm keep it to a single page. But the ledger and the register cost almost nothing, and they are what make every other clause checkable. Six hours is a very short time to reconstruct what an agent did at 2 a.m. on a Sunday. A ledger means nobody has to.
Guidelines that cannot be audited quietly become good intentions. I hope these become furniture.
With regards,
Hemen Parekh
www.Iam-Immortal.ai / www.IndiaAGI.ai / www.YourContentCreator.in
06 Nov 2026
No comments:
Post a Comment