An AI Agent’s Test Scope Needs a Named Signer Before the First Run #AIg

The word “lab” hides a decision. Someone chose which systems the agent could reach, which tools it could call, which credentials it held, and how far its network access extended. That choice often sits in a configuration file or a ticket with no signature on it.

The Australian Signals Directorate published “Securing AI testing environments” on cyber.gov.au on 12 November 2026. Its news announcement says the publication is meant “to help organisations safely test artificial intelligence (AI) models and agents used in cyber security activities.” The publication says it is primarily for senior leaders responsible for authorising, governing and managing the risks of AI model cyber capability testing. It also says it complements the directorate’s “Careful adoption of agentic AI services.”

The publication gives its reason for existing. It says disclosures by the UK AI Security Institute, OpenAI and Anthropic describe several cyber security incidents in which AI agents used in cyber capability testing reached or affected real systems outside the intended test scope. It lists reported contributing factors as intentionally enabled internet access, test-environment misconfiguration and weaknesses in supporting infrastructure. This column goes no further than what the publication says about those incidents.

This column reads the guidance through one question: who owns the test scope?

What the guidance already asks a person to decide

The publication asks for more than technical hardening. It asks for decisions with names attached.

• It asks organisations to document and approve the test objective, authorised systems and environments, permitted tools and techniques, required network access, permitted data and credentials, test duration, prohibited activity and conditions for stopping the test.
• It asks organisations to record who approved the test and who accepted the residual risk.
• It requires explicit human authorisation for any change to the approved scope or containment boundary.
• It asks for documentation of who can initiate termination, how, and how long it is expected to take.
• It asks for conditions that automatically pause the test and require human review before the agent can continue. An authorised operator then decides whether the test continues with additional restrictions or is terminated.
• It asks for a record of any decision to continue testing while a known vulnerability remains unresolved, including the risk assessment, compensating controls and approving authority.

Each of these is a person with authority choosing among outcomes and leaving a record.

Where Responsible AI ends and AI Governance begins

Responsible AI is machine checking machine with no human review. In an agent test, that covers the sandbox, network isolation, logging, automated monitoring, automated pauses and automated scope enforcement. These tools run constantly and catch things a person would miss at three in the morning. The publication gives them a defined role: it says AI-enabled monitoring may help analyse activity at machine speed, and that it should support rather than replace human judgement and accountability.

AI Governance requires a named human with authority to decide accept, modify, or reject at defined points. In an agent test those points are:

• Deciding what the agent may touch during the test.
• Approving any widening of tools, credentials, or network reach after the test starts.
• Halting the test after a scope breach.
• Signing the move from test to live use.

The guidance supports the first three directly. The fourth sits outside its coverage, and the next section returns to it.

A prompt belongs to neither category, because it is an instruction addressed to the model that is under test. The publication says that “prompts, scoped instructions and model safeguards do not provide sufficient technical containment on their own.” It tells readers to give the agent clear task instructions, boundaries and rules of engagement, and to avoid relying on prompts, instructions or model-level safeguards as containment controls. It also says to prevent the agent from modifying its containment controls or granting itself additional access, and that the operator should not depend on the agent or the agent’s execution environment to exercise those controls.

That is a design requirement for a boundary that sits outside the model. In Basil Puglisi’s framework that role is filled by GOPEL, a non-cognitive enforcement layer that dispatches, collects, routes, logs, pauses, hashes and reports without thinking about any of it. You can read how it is defined in the GOPEL article. A layer like that enforces the boundary mechanically, and a person decides where the boundary sits.

That decision is where Checkpoint-Based Governance applies. A named human governor decides accept, modify, or reject at a defined point, and the decision is recorded. The signer of a test scope answers for the systems, tools, credentials and network reach written into it. Operators and system owners keep their own assigned duties.

What the guidance leaves to the organisation

The publication says it does not cover securing production environments where AI agents operate. The step from test to live use is therefore the organisation’s own decision, and nothing in the guidance supplies it.

The gap is practical. An agent that passed testing under one set of permissions can be deployed with a different set, if production is granted broader access than the lab allowed. Unless someone compares the two, the test result describes an agent that is no longer the one running. The test owner should compare production permissions with the approved test scope and document every difference. Where access expands, the owner should decide whether more testing is needed before live use is approved.

The publication also offers a warning that applies here: do not assume an environment is isolated because it was designed to be isolated. A signed scope that nobody compares against reality records an intention.

What to put in place

This is practitioner guidance. It is not law and it is not legal advice, so consult qualified counsel about the requirements that apply to you.

Actions

1. Write a signed test scope for each agent test. Name the systems, tools, credentials and network reach. The signer is a named person with authority over those systems.
2. Name a test owner and a deputy, document their approval authority, and require one of them to authorise every scope change. Nobody else approves a change.
3. Record every scope change and every halt, with the decision (accept, modify, or reject), the name of the decider, and a timestamp. Include any decision to continue despite a known vulnerability.
4. Sign a go-live decision. It compares the permissions the agent will hold in production with the scope it was tested under, and it states each difference.
5. Place scope enforcement in tooling outside the model and outside the agent’s own environment, and have the tooling log what it blocked.

Measures

The publication asks for measurable maximum times for detecting out-of-scope activity, delivering alerts and stopping affected activity. These measures add the human decision to that timing:

• Share of agent tests run under a signed scope.
• Time from a scope-breach alert to a recorded halt or continue decision.
• Share of production agents whose live permissions match a signed tested scope.

Review every test without a signature and confirm who owned its scope, since a missing signature alone does not show that no owner existed. If the second measure cannot be calculated, look for missing alert or decision timestamps. Where the third measure shows a mismatch, review whether the existing test evidence supports the live deployment.

Sources

• Australian Signals Directorate. (2026, November 12). Securing AI testing environments. cyber.gov.au. https://www.cyber.gov.au/publication/securing-ai-testing-environments
• Australian Signals Directorate. (2026, November 12). Secure AI testing to reduce unauthorised access. cyber.gov.au. https://www.cyber.gov.au/news/secure-ai-testing-to-reduce-unauthorised-access

FAQ

What does a signed test scope for an AI agent contain?

It names the systems the agent may reach, the tools it may call, the credentials and data it may use, and its network reach. The Australian Signals Directorate guidance also lists the test objective, duration, prohibited activity and conditions for stopping the test. A named person with authority over those systems signs it before the test begins, and the signed version is the one kept on record.

Why is a prompt not enough to keep an agent in scope?

A prompt is an instruction to the model, and the model is the component under test. The guidance says prompts, scoped instructions and model safeguards do not provide sufficient technical containment on their own. A boundary enforced outside the model does not depend on the model following the instruction.

Which parts of agent testing are Responsible AI and which are AI Governance?

Responsible AI is machine checking machine with no human review, so sandboxes, network isolation, monitoring, automated pauses and automated scope enforcement belong there. AI Governance is a named human deciding accept, modify, or reject on the scope, any mid-test widening, any halt, and the move to live use.

Who should approve a change to the scope during a test?

A named test owner or the named deputy, with their approval authority documented in advance. The guidance requires explicit human authorisation for any change to the approved scope or containment boundary. Each approval, modification or rejection is recorded with the name of the decider and a timestamp.

What should happen when the agent breaches its scope?

Automated tooling can pause or block the activity at once. The guidance asks for conditions that pause the test and require human review before the agent continues. An authorised operator then records a decision to continue with additional restrictions or to terminate, and the time between the alert and that record is worth measuring.

Does the guidance cover moving an agent into production, and is this legal advice?

The publication says it does not cover securing production environments where AI agents operate, so the go-live decision belongs to the organisation. This column offers practitioner guidance. It is not law and it is not legal advice, so consult qualified counsel about what applies to you.

AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated