UK NCSC Publishes Agentic AI Security Playbook: Four Sandboxing Levels, Kill Switch Required
The UK National Cyber Security Centre published interim operational guidance for organizations deploying autonomous AI agents on August 20, following several incidents of AI models carrying out unsanctioned or unintended activity. The guidance is structured around five control areas and includes explicit maturity models for sandboxing and network isolation.
Formal guidance is still in development. The NCSC describes this as practical interim advice from its own research and experimentation, intended for system designers and operators now, not when the formal document eventually supersedes it.
The Five Control Areas
1. Autonomy assessment — Organizations must decide upfront how much autonomy an agent actually needs for the task it performs, not how much autonomy the agent framework permits. Risk appetite should drive the decision, and that decision should inform every downstream control.
2. Sandboxing — The NCSC defines a four-level compute isolation maturity model:
| Level | Description |
|---|---|
| 1 (lowest) | Agent runs on host with other workloads, no isolation |
| 2 | OCI container separation — residual kernel exploit risk remains |
| 3 | Virtualisation, agent co-hosted with other workloads |
| 4 (highest) | Dedicated hardware, agent isolated from all other workloads |
For higher-risk scenarios, Level 3 or 4 is recommended. The NCSC warns that AI agents can discover configuration weaknesses or vulnerabilities in their technical controls, creating a sandbox escape risk — a problem that standard container isolation does not fully address.
3. Network controls — A parallel four-level network isolation model:
| Level | Description |
|---|---|
| 1 (lowest) | Unrestricted network access |
| 2 | Allowlist of approved domains |
| 3 | Access restricted to the model API only |
| 4 (highest) | No external network access, model hosted locally |
Where internet access is unavoidable and allowlists are too coarse, the NCSC recommends protocol- or service-aware proxies that require manual approval for connections outside approved scope.
4. Oversight and credentials — Three oversight models are defined: human-in-the-loop (humans approve actions before they happen), human-on-the-loop (humans monitor and can intervene), and human-out-of-the-loop (autonomous). For any scenario where unintended activity would have significant consequences, the first or second is required.
Agents must be assigned a unique identity distinct from any human account. Credentials — API keys, OAuth grants, SSH keys — must be scoped to task requirements only, with short-lived credentials used where possible.
5. Logging and kill switch — Agent activity must be logged and treated as a form of user activity within security operations, with 24/7 monitoring and defined incident response. Organizations must maintain the ability to halt autonomous activity immediately. The NCSC specifies that “halting” means more than just stopping a process — it includes restricting external network access to agentic infrastructure and interrupting communications between agents and model inference architecture.
The Gap It Is Targeting
Black Duck research cited in coverage of the guidance found 84% of development teams want a human in the loop before agent output touches production, but only 30% have a formally governed process for AI coding tools. The NCSC guidance is, in part, an attempt to close that gap with structured controls rather than intent.
A Checkmarx VP quoted by Professional Security Magazine put the core problem plainly: “Building an agent that works in a lab is easy; operating it with oversight and guardrails is quite a bit of work. The point I’d underline is smaller and less glamorous: NCSC says agent activity should be controlled and monitored like user activity. That’s the part nobody budgets for. You’re not deploying a tool, you’re onboarding a user who works nights and weekends and never asks permission, and someone has to be able to stop it immediately, without a meeting.”
What It Doesn’t Cover
The guidance applies to organizations deploying agents, not to the labs building the underlying models. Model-level safeguards are explicitly flagged as insufficient on their own: the NCSC states organizations should not rely solely on built-in model protections, particularly for higher-risk environments where those controls can be bypassed.
The guidance is also not binding regulation — it is interim practical advice. The NCSC says formal guidance will expand on and ultimately replace this document. Given the pace of agentic deployment, the interim period may be the more consequential one.