On January 9, 2026, the Secretary of War signed an Artificial Intelligence Strategy for the Department of War that reads less like a policy memo and more like a starting gun. It directs the Department to become an "AI-first" warfighting force and lays out seven "Pace-Setting Projects." Two of them are explicitly about autonomous software agents.
"Agent Network" is defined as "Unleashing AI agent development and experimentation for AI-enabled battle management and decision support, from campaign planning to kill chain execution." "Enterprise Agents" is about "Building the playbook for rapid and secure AI agent development and deployment to transform enterprise workflows." The strategy is unambiguous about tempo: it commits to fielding the latest models "within 30 days of public release" as "a primary procurement criterion," pushes AI compute "from datacenters to the edge," and states plainly that "the risks of not moving fast enough outweigh the risks of imperfect alignment."
Months later, on the security side of the same government, a very different document landed.
The Five Eyes wrote the agentic AI security playbook
Six cyber-security authorities across the Five Eyes — the Australian Signals Directorate's ACSC, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), the Canadian Centre for Cyber Security, and the New Zealand and United Kingdom National Cyber Security Centres — published joint guidance titled Careful adoption of agentic AI services. Its opening line is aimed squarely at this reader: "Agentic artificial intelligence (AI) systems increasingly operate across critical infrastructure and defence sectors and support mission-critical capabilities."
The authoring agencies then draw a line most vendors won't. They recommend "adopting agentic AI with security in mind, assessing its use and never granting it broad or unrestricted access, especially to sensitive data or critical systems."
That is the whole tension for defense programs in one sentence. The mission side is racing to wire agents into battle management and enterprise workflows. The security side is saying: do not hand these systems broad access to sensitive data.
Agentic AI is not ChatGPT — and the difference is the data
The guidance is careful to separate agentic AI from the generative-AI chat tools most governance programs were built around. Generative AI produces content for a human to use; "agentic AI builds on GenAI by integrating with software systems to create autonomous agents that can independently reason, plan and take actions without requiring human intervention." Agents are "intended to operate without continuous human intervention," and some can autonomously create — or "spawn" — sub-agents.
That autonomy changes where your data goes. An agent doesn't just answer a prompt; it reads external data sources, calls tools, and writes to other systems. The guidance notes agentic systems "often handle and contain a significant amount of sensitive information," including "user information like prompts or goals, organisational data stored in a RAG system and secrets like API keys." It also warns that "two-way tool integration allows tools to send potentially arbitrary instructions back to the LLM" — the prompt-injection path, but now with the ability to act.
For a defense contractor or a defense-tech builder, "organisational data" is CUI, ITAR-controlled technical data, and mission specifics. The failure mode isn't hypothetical: the guidance walks through "confused deputy" attacks, privilege compromise, and "rogue agents" that can "exfiltrate data, alter logs and propagate malicious plans peer-to-peer."
What the guidance actually asks for
Read past the risk taxonomy and the recommendations converge on a specific architecture. The authoring agencies call for:
- A control at every data crossing. "Apply security controls at all points where information enters or exits the system, including user inputs, tool calls, data pre-processing and model inference."
- A centralized decision point, checked continuously. Governance of autonomous agents requires "continuous runtime authentication with centralised policy decision points for each action," and operators should "continuously verify identity and authorisation at runtime using a centralised policy decision point for each request."
- Fail-safe defaults. "Set system configurations to fail-safe by default requiring agents to stop and escalate issues to human reviewers in uncertain scenarios," and "deploy a secondary agent to validate new tasks against policy before execution."
- Auditability that survives scrutiny. "Integrate unified audit logs for all inter-agent interactions," and "log agent tool usage and ensure results are captured in system logs in a human-readable format."
- Harmonization with existing frameworks — "such as common Zero Trust principles" — rather than a bolt-on. For OT and industrial environments, the guidance points to CISA's "Principles for the Secure Integration of Artificial Intelligence in Operational Technology."
Notice what this list is not. It is not a training module or an acceptable-use policy. It is enforcement — at the data boundary, at runtime, on every action that crosses it.
Governing the agent's actions is only half the problem
There is a growing category of tools focused on governing what an agent is allowed to do next — its permissions, its tool allow-lists, its orchestration. That layer matters, and the guidance calls for it directly ("codify separation of duties," "restrict tool use to an approved allow list"). The OWASP "Top 10 for Agentic Applications for 2026," which the guidance references, lives largely in that layer too.
But controlling the agent's action space does not, by itself, control the data crossing the LLM boundary on the way to a third-party model or an external tool. These are two complementary layers. One governs behavior. The other governs the sensitive data leaving your environment at each inference and each tool call. A defense program that instruments the first and assumes it covers the second has an audit gap exactly where the guidance says to put controls: user inputs, tool calls, pre-processing, and model inference.
Where Containment.AI fits
Containment.AI is building toward that second layer as a Mission Authorization Gateway: a centralized policy decision point that inspects and enforces policy on the data crossing the LLM boundary — prompts, retrieved context, tool inputs and outputs — and produces signed, human-readable audit records of every crossing. That maps directly to what the Five Eyes guidance asks for: controls at each entry and exit point, a centralized decision point evaluated per request, fail-safe-by-default behavior, and unified, human-readable logs.
The connected-tier controls — the browser extension and the LiteLLM proxy — enforce policy on the GenAI browser and API surface today. The Mission Authorization Gateway extends the same deterministic, non-bypassable enforcement toward the agentic and edge surface the Department of War is now racing to field.
The strategy says the Department will accept that "the risks of not moving fast enough outweigh the risks of imperfect alignment." Fair enough. But its own coalition's security agencies have already written down what not imperfect looks like: agents that stop and escalate, a policy decision point on every action, and an audit trail you can hand to an assessor. The guidance's own conclusion urges "prioritising resilience, reversibility and risk containment over efficiency gains." The data boundary is where those requirements live — and it is not the layer that gets built when speed wins.
If your program is standing up agents against the "AI-first" mandate, the data boundary is the part of the playbook you cannot defer. Talk to us about the design-partner program.