ASD now expects an AI agent register. Here is what that means for a small business

Two things happened this month that most Australian businesses have not noticed yet.

First, the Australian Signals Directorate (ASD) updated the Information Security Manual (ISM) in September with eight controls aimed at AI agents. Second, on 11 September ASD published guidance on the software layer that sits around an AI model and lets it act. ASD calls that layer a "harness" in the title of the document. We will call it the agent platform.

If you run a business on Microsoft 365, or you are the MSP who looks after one, here is what changed and what to do about it.

What an AI agent is, in one paragraph

A chatbot answers a question. An agent does things. It reads your email, opens files in SharePoint, fills in a form, sends a message, calls another system. Microsoft 365 Copilot agents, Copilot Studio bots and the AI tools your staff plug into Teams and Outlook are all agents. Each one signs in to your tenant with some identity and holds some set of permissions.

That is the point ASD is making. The risk is not the model. The risk is what the model is connected to.

The eight ISM controls, in plain English

The ISM is the standard the Australian Government holds itself to. For a private business it is guidance, not law. But it is the guidance your insurer, your government buyer and your auditor read, and it is the standard the Essential Eight is grounded in. The September 2026 changes are in the official ASD changes document, linked at the bottom.

Control	What it asks for
ISM-2133	Every AI agent gets its own identity, separate from staff accounts and from other agents.
ISM-2134	Keep an AI agent register. Maintain it. Verify it on a schedule.
ISM-2135	The register records, for each agent: its identifier, its owner and business purpose, the identities assigned to it, any accounts and credentials it uses, and the tools, permissions and data it can reach.
ISM-2156	Agents are limited to the minimum tools, functions and permissions their purpose needs.
ISM-2157	When an agent uses a tool, its access is capped by both the user's own rights and a task-scoped grant for the agent. The smaller of the two wins.
ISM-2158	Anything an agent reads, such as web pages, documents or emails, is treated as untrusted. It stays separate from the agent's instructions and can never change its permissions or approval rules.
ISM-2113	A person must approve before an agent runs a sensitive or high-impact action. This used to say "flag for approval". It now says "require approval".
ISM-2159	Every tool call, external request and output an agent makes is centrally logged, in enough detail to investigate an incident.

Why the register is the one to start with

Five of the eight controls are about limits and logging. You cannot set limits on agents you have not listed. So the register comes first.

The good news is that Microsoft Entra ID already holds most of what ISM-2135 asks for. Every app and agent connected to a Microsoft 365 tenant is a service principal. Entra ID knows its identifier, whether it is an agent identity, what application permissions it holds, and which tenant-wide consents an administrator has granted it. Microsoft added a dedicated agent identity type to Entra ID this year, so agents built the right way already show up as agents.

Two fields are not in Entra ID: the owner and the business purpose. Those are a human decision, and the ISM says they must be recorded. Nobody can automate that honestly.

What a 20-person business can actually do

You do not need an E5 licence or a security team. Here is the order that works.

Build the register. List every non-Microsoft app and every agent identity in the tenant, with its permissions. Do this from Entra ID, not from memory.
Read the high-privilege rows first. An app with application-level rights to read all mail, or write to every SharePoint site, needs a reason. If nobody can name one, remove the permission.
Turn off self-service consent. If users can consent to any app themselves, an agent can acquire permissions with no governance step. In Entra ID this is one setting under user consent.
Give each agent an owner and a purpose. One sentence each. Write it in the register.
Answer the rest honestly. Human approval, logging, untrusted content. If the answer is "no", write "no". A register with honest gaps is worth more than a tidy one that was never true.
Re-check on a schedule. ISM-2134 says regularly verified. Quarterly is a sensible start.

What this means for MSPs

Your clients are going to be asked for this register. The ask will come from an insurer at renewal, from a government buyer in a tender, or from an auditor who has read the new ISM. Most clients will not know what an AI agent register is when the question arrives.

That makes it a service line. The register is a report you can hand a client every month with your name on it. It uses the same tenant connection you already have for Essential Eight, and the same evidence format.

CYBERWHITE builds the register from Entra ID in one read-only scan, runs the three checks that Entra ID can answer (application permissions, tenant-wide consents, user consent policy), and records your answers to the rest with who answered and when. Every control is traced to its ISM number. It is an add-on to our MSP and Business plans, and you can read what it does and does not do on the AI Agent Governance page.

One thing to be careful about

ASD's guidance is written for large organisations and government. It says, in plain terms, that no fully reliable technical fix exists for prompt injection, and that organisations should start with low-risk uses and keep a person accountable for every outcome. That applies to a 20-person business too. If a vendor tells you their agent is safe because the model is safe, ask what the agent can reach and who approves what it does. Those are the ISM's questions. They are the right ones.

Sources

Keep reading: SMB1001:2027: What Changes for Your Business (and What to Do Now) and AI usage policy for clients: a one-page quick win