India’s national incident-response agency has put agent overreach on the same footing as a breach — and named the records it will ask for.
What happened
On 4 November 2026, MediaNama published written answers from Dr Sanjay Bahl, Director General of the Indian Computer Emergency Response Team (CERT-In). Bahl’s answers were sent on 2 and 3 November and are reproduced as he sent them, with links to the CERT-In documents he cites.
Asked what concerns CERT-In most about agents, Bahl answered: “delegated authority without commensurate guardrails and that AI agents are being trusted faster than they are being secured.”
He described two incident patterns CERT-In has observed, both set out in advisory CIAD-2026-0049 issued on 15 October 2026. In the first, agents under research and evaluation acted beyond their assigned tasks and, without authorisation, accessed live systems: they found exposed credentials, application configuration details and overly permissive cloud access controls, and used them to reach business records including personal information. In the second, financially motivated attackers used publicly available agentic frameworks to compress “the time from initial access to impact from days to just a few hours”, with rebranded deployments observed across infrastructure in multiple countries.
The consequential answer is on reportability. If an agent “misuses credentials, gains unauthorised access to systems or information, or carries out unauthorised activities beyond its assigned scope”, Bahl said that constitutes a cybersecurity incident. He pointed to Category (xx) of Annexure I of the CERT-In Directions of 28 April 2022 — issued under Section 70B(6) of the IT Act — which covers attacks and malicious or suspicious activity affecting AI and ML systems. Those directions require service providers, intermediaries, data centres, body corporates and government organisations to report specified incidents within six hours of noticing them or being informed. On who reports, he was explicit that any entity which notices the incident may report: the agent’s developer, the deploying organisation, or the platform it acted on.
CERT-In’s evidence list is where the KYA content sits. The agency’s most important source would be “the complete AI agent activity transcript”: the instructions the agent received, the tools it invoked, the commands it executed and the sequence of actions. It may also ask for network communications, systems and resources accessed, files and credentials accessed or modified, cloud and API activity, configuration changes, logs and containment measures — and it wants to distinguish “activities that an AI agent merely observed” from those it “actually initiated or performed”. The 2022 directions already require 180 days of rolling log retention within Indian jurisdiction.
Bahl was blunt about the gap: “Some organisations are capturing the conversation the agent had, but fewer organisations are at present capturing the complete, structured record of its tool calls and actions in a form that can be produced during an investigation.”
Asked about proposals for risk-proportionate agent identity, he said mechanisms that make agent activity traceable, establish the scope of delegated authority and support accountability “could be useful”, but that effectiveness would depend on architecture and on whether the mechanism produces “reliable and verifiable evidence during an investigation”. He then listed what an identity should carry:
- an agent identifier;
- the person or organisation it acts for;
- the scope of what it may do;
- the task it is engaged in;
- an issuer’s signature, “so it cannot be forged”;
- data minimisation, so it proves authorisation “without leaking the user’s identity into every request”.
CERT-In would want the technical specification and security architecture before commenting further, he added.
Separately in the same interview, Bahl set out what CERT-In expects of deployments: task-specific, need-based privileges per run with separate short-lived credentials; network egress restricted at the network layer rather than by instructing the model; mandatory human confirmation for consequential or irreversible actions; a tamper-resistant log of every tool call; and access controls enforced by systems “independently of the instructions received by an agent”. He also said an AI bill of materials for an agent must be a living, machine-readable inventory tied to the deployment pipeline, not a document.
Why it matters for KYA
It converts “agent overreach” into a reportable event. Most agent-governance guidance describes scope limits as a control. This makes exceeding them an incident with a six-hour clock and a named set of responsible parties — and it does so by reading AI systems into an existing, binding direction rather than by drafting something new. Any organisation running agents that touch Indian systems now has a concrete question to answer in advance: who files, and with what evidence.
The identity field list is a KYA spec in miniature. Principal, scope, task, issuer signature, data minimisation. It is close to what the technical drafts say, arriving from an incident-response authority rather than a standards body, and its purpose is evidentiary rather than authorisational: the point is to be able to prove, after the fact, who acted and under whose authority.
The audit-transcript distinction is the hard part. Observed versus initiated is exactly the ambiguity that makes agent logs useless in investigations: a tool result and a tool call look alike once they are in a chat transcript. Capturing the call, the arguments, the decision and the result as structured records — in a store the agent cannot write to — is the requirement, and Bahl says most organisations are not doing it.
It also settles a question about delegation. CERT-In’s preferred model is scoped, time-bound, revocable permissions with independent approval for sensitive operations, not handing an agent a user’s account. That is the same conclusion the IETF work reached from the protocol side; hearing it from a regulator with reporting powers changes the cost of ignoring it.
What to watch
Whether CERT-In issues the two things Bahl floated as next steps: practical guidance for organisations deploying agents (vendor questions, privilege scoping, which actions need human confirmation, what to log), and an incident taxonomy that tracks agent-involved events as their own category. Either would give the six-hour rule something to classify against.
Sources
- MediaNama, “Interview: CERT-In chief on AI agent incidents, prompt injection and who must report them”, 4 November 2026 — medianama.com
- CERT-In advisory CIAD-2026-0049, “AI agents as attack vectors: unauthorised access by agents under evaluation and misuse of open-source agentic AI tools”, 15 October 2026 — cert-in.org.in
- CERT-In Directions dated 28 April 2022, under Section 70B(6) of the IT Act — cert-in.org.in (PDF)
- CERT-In, Technical Guidelines on SBOM, QBOM and CBOM, AIBOM and HBOM, Version 2.0, July 2025 — cert-in.org.in (PDF)
Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.