On Tuesday, Japan's Digital Agency started giving artificial intelligence (AI) agents to the government's own staff. Agent Chat, which lets an official build and run an agent by typing what they want done, reaches ministries in stages from October 20. A stronger coding workspace, Gennai Workshop, is due around December. The government platform, called Gennai, serves about 180,000 civil servants, and the agency says no other government has put tools like these into everyday use at that scale.

The rules came out the same day, written with Japan's AI Safety Institute, and they read like a code of conduct for a new hire. Staff check an agent's work before anything important happens, never paste unchecked output into official documents, and stop any run that does something they didn't ask for. Web pages and files are treated as possible carriers of hidden instructions. Unapproved "shadow AI" is banned, high-risk uses go to each ministry's chief AI officer, and the Workshop is open only to staff who pass a literacy check and are cleared by a manager. Digital Minister Toshiharu Furukawa said agents raise the risk "a little," which is why the government should go first. The code is due out as open source around February 2027. (Digital Agency summary, in Japanese; ITmedia, in Japanese; MediaNama)

Tokyo is deciding what its staff may do with agents. Washington is deciding whose models may run at all. On Tuesday the Department of Homeland Security (DHS) published an order in the Federal Register that bars DeepSeek, the Chinese AI lab, from federal civilian purchasing. It also tells agencies to remove DeepSeek products, and any third-party products or services built on them. The order was signed months earlier, and the Defense Department falls outside it.

The legal basis is a 2018 supply chain security law and a review by the Federal Acquisition Security Council. Homeland Security Secretary Markwayne Mullin pointed to data stored on servers in China and the chance that prompts carry sensitive government information there. He told agencies to watch their traffic and tighten logging until the removal is done. Exceptions need a written, compelling justification. For companies, the clause to read twice is the third-party one: if a vendor's product quietly runs on DeepSeek, it is out too. (Federal Register notice; CyberScoop; CNBC)

Bank boards got homework of their own last week. On October 15 the Financial Stability Board (FSB), which brings together financial authorities from 24 jurisdictions and is chaired by Bank of England Governor Andrew Bailey, published 12 final sound practices for adopting AI. It "strongly encourages" boards and senior management to use them when they shape their AI governance. The list opens with the board's job, matching AI use to strategy and risk appetite, and ends with risks from outside AI suppliers.

The passages on agents are the sharpest. An agent's risk can multiply as its permissions grow, so firms should weigh any new access together with what the agent already has. They should also build and test "kill-switch" mechanisms that pause, limit, override or remove an agent's access. The report describes an insurer whose agents, during testing, could be coerced into trying to reach systems they had no permission to use, in one case trying to delete data files. The practices are voluntary, but they come from the people who write the binding rules. (FSB announcement)

Japan is not the first to write rules like these. Australia's Digital Transformation Agency (DTA) put out an agentic AI addendum to its government AI technical standard in May, last updated in June, with 25 new criteria. A named person answers for an agent's decisions, even across many steps taken on its own. Oversight has to keep a human in the loop or on it. Each agent gets its own identity and only the access it needs, and agencies set minimum technical requirements for kill switches.

There is a catch. The addendum calls itself best-practice guidance, and the policy that binds Australian agencies only strongly recommends the standard it extends, as the AI Geek site pointed out this month. Both countries now sit on a new working group on agentic AI in government at the Organisation for Economic Co-operation and Development (OECD), alongside Korea, Canada, Estonia, Israel, Singapore and the UK, so expect these rulebooks to be compared line by line. (DTA addendum on digital.gov.au; OECD working group; AI Geek)

Already filed, if you want the run-up: The Stake (Anthropic putting 5% of its shares into a public benefit fund), The Label (Indonesia drafting rules to label AI-made content), and The Near Miss (London wanting AI near misses reported).

Also on the shelf: The Brake (Satya Nadella on treating models as insider risks), The Accord (the White House pact on frontier AI duties) and The Oath (New York's Council putting SpaceXAI under oath). Read today beside The Brake. That one said to treat a model like an insider. Japan has now written the insider's handbook.

Machines that act on their own have failed loudly before. On August 1, 2012, Knight Capital's order router still carried an old function that nobody used and nobody had removed. A botched software update woke it up, and in the first 45 minutes of trading the router sent more than 4 million orders while trying to fill 212 customer orders. Knight traded more than 397 million shares and lost more than $460 million. Before the market opened, an internal system had sent staff 97 automated emails pointing at the problem. Nobody acted on them.

When Knight settled with the Securities and Exchange Commission (SEC) in October 2013, paying $12 million, the list of failures read like an agent checklist. There was no control comparing orders leaving the router with the orders that went in, no link to the firm's overall exposure, weak testing of new code, and no written playbook for staff in a technology incident. Swap "router" for "agent" and you have the FSB's kill-switch paragraph, 13 years early. (SEC press release, October 16, 2013)

Put these to management. Which of our systems can now take actions on their own, and for each one, who is the named person who answers for what it does? Who can stop it, how quickly, and when did we last test that? When an agent asks for more access, does anyone look at what it can already reach?

Do we know which AI models sit inside the software we buy, so that a ban like the one on DeepSeek doesn't reach us through a vendor? Do our people have an approved tool, or are they using whatever is open in their browser? Japan banned shadow AI for 180,000 public servants in one line. We should know whether we have it.

The Move

Japan has written down, for 180,000 public servants, what a careful organization expects of people who work with agents. Check the work, stop the strange run, keep secrets out, use the approved tool, and own the decision.

Ask the chief information officer and the chief risk officer to bring one page to the next board meeting: every AI agent we run or plan to run, the person accountable for each, what it can touch, how it gets stopped, and which outside models sit underneath.

If no one's name is next to an agent, no one is watching it. Start there.

Seven bullets. One move.