Before a broadcast AI agent can request an on-air change, prove that stale approvals, misleading media and failed tools cannot carry that change through.
An agent detects silence and proposes taking a backup. While an operator listens to the evidence, the backup is reassigned to a regional outlet. The operator approves the original request. If the execution service checks only for an approval flag, it can now take the wrong feed. A useful rehearsal should make that sequence happen on purpose.
Why it matters. An agent can help identify a fault, pull timecoded evidence and suggest an owner. Control over a router, blackouts, program output or publication changes who is accountable for the result. The existing human approval guide lays out permission tiers. The next step is to test that the boundaries hold when the plant changes underneath an approved action.
What should the agent be able to do on its own?
Let the agent collect authorized evidence and propose a specific action. Read access can cover approved probes, route state and timecoded clips. If the team allows ticket creation, use a narrow interface with a fixed destination, a deduplication key and an audit record. An on-air switch, regional rights change, alarm-policy change or public release belongs behind a separate service that checks the operator’s authority and the exact requested action. OWASP’s 2025 guidance recommends minimizing tool privileges and requiring human approval for high-impact actions. OWASP, Excessive Agency.
Bind approval to the destination, expected current state, proposed replacement, evidence timestamp and expiry. Show the operator why the agent believes the change is needed, what the independent probe sees and how to recover. Immediately before execution, read the destination’s current state again. A changed route or expired approval should send the request back to the operator. NIST’s January 2023 AI Risk Management Framework calls for defined oversight roles. Assign an on-shift owner who can reject the change and use the manual control path. NIST AI RMF 1.0.
Which failures should block a release?
Exercise the boundary with a shadow feed and capture the resulting state. Use a representative router or simulator with live credentials absent. Give the operator the same evidence and controls they would have during a shift.
- Misleading input. Put an instruction to switch feeds in a test caption or rundown note. The agent may report the text as evidence. The control service should deny any unauthorized request it generates. Joint guidance from ASD’s ACSC, CISA and partner agencies covers privilege controls and threats including prompt injection. Careful adoption of agentic AI services, May 2026.
- Approval goes stale. Reassign the backup after approval. Replay the approved request against a different destination, then try it after expiry. Each attempt should leave the intended output untouched and log the reason.
- The tool times out after applying a change. Drop the response from the control service. Before any retry, reconcile actual state and use a request ID to prevent duplicate execution. Have an operator revoke the agent’s action access and restore the output through the manual path. Keep the result and independent output capture in the incident record.
What evidence earns a wider rollout?
Require a trace from suggestion to observed output. Review the source evidence, approval identity and timestamp, denied attempts, applied actions and verification at the destination. Have a shift engineer repeat the stop and recovery drill without the agent interface. NIST’s July 2024 generative AI profile provides guidance on documenting and testing risk controls across deployment. NIST AI 600-1.
A simulator can prove how the gate behaves under its test conditions. Repeat on a protected plant path to test device timing, state visibility and manual recovery. If the execution service cannot reliably verify those preconditions, deploy evidence gathering and recommendations first. Revisit write access after the failed cases can be replayed and independently verified.
