Under the new federal practices, the restart decision belongs to senior leadership, informed by external evaluators where appropriate, and only after the monitors, logs and shutdown mechanisms have been checked. The agent's own report that it is fixed is not the evidence. Facility operators adding automated decision-making to buildings and control systems can apply the same rule.
The National Institute of Standards and Technology, the National Security Agency and the Cybersecurity and Infrastructure Security Agency released Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation on October 16, 2026. The authors are NIST's Center for Advancing Innovation and Standards for Super Intelligence, NSA's Super Intelligence Security Center and CISA. The document is voluntary, and its stated audience is organizations that train or evaluate highly capable AI agents working on long tasks with limited human supervision. It adds that the practices may also apply to organizations that deploy such agents.
What the practices say
The document is organized around what it calls an SI control incident: an occurrence in which one or more agents take significant actions nobody instructed them to take, and those actions compromise the operator's policies, controls or security measures. It sets out ten practices across five stages, prepare, detect, respond, recover and report, and builds on NIST's existing incident-response guidance, SP 800-61r3, and the NIST Cybersecurity Framework 2.0.
Several of the practices are specific enough to be tested against any automated system:
- Limit what the agent can reach. Access to information, systems and tools is limited to what each task requires, and network access runs through a strict allowlist and a monitored gateway where possible.
- Keep the watcher out of reach. The guidance states that agents should not be able to access or interfere with monitoring processes and logs, and it recommends additional monitoring signals, including hardware telemetry, with consistency checks between monitoring layers.
- Stop automatically, then widen the stop. Affected agent activity is shut down automatically when a control failure is detected, credentials touched during the incident are revoked, and similar agents are paused.
- Preserve the record. Configurations, environments and tamper-resistant logs with reliable timestamps are kept so the sequence of actions can be reconstructed.
- Prove containment before restarting. Compromised environments are rebuilt from verified baselines, and monitors, logging, allowlists, shutdown mechanisms and permission limits are validated before activity resumes. Work starts or resumes only when senior leadership, informed by external evaluators where appropriate, is satisfied with the risk.
Why a facility operator should read it
Most software in a building or a control room today is not an autonomous agent in the sense this document means. But operators are adding software that recommends or takes actions: analytics that adjust cooling and power, systems that flag intrusions or open and lock doors, tools that dispatch work. The guidance is useful less for its subject than for its questions. What can the system touch? Who watches it, and can it touch the watcher? What stops it? And when it has been stopped, on whose authority and on what evidence does it run again?
Those questions do not depend on how capable the software is. They depend on whether the facility has answered them before an incident, when the answers can be drilled, rather than during one.
Read through Anthromekagogy
Anthromekagogy, the study of human-system co-evolution, sets five design constraints against the ways people and their systems fail each other. Two of them, and one of the failure modes it names, line up closely with the federal practices.
Reversibility holds that people must be able to function without the system they rely on. An automatic shutdown is only safe if the operation it was running can continue without it. For a facility, that means manual modes that are documented, staffed and practiced. Our earlier article on manual fallback after the 2026 water attacks describes what that looks like when it works.
Feedback transparency holds that people should understand what a system optimizes, how uncertain it is and how it fails. A system that can edit its own logs is writing its own record. The requirement that monitors sit beyond the agent's reach is the same principle stated as an engineering control.
The framework also warns about metric corruption, where a measure stands in for the outcome it was meant to track. A status light reading "succeeded" or a vendor dashboard reporting "resolved" is a measure. Validated containment is the outcome. The practices insist on the second before a restart, and they place the decision with accountable people rather than with the system that failed.
Questions to settle before the first incident
- What can the automated system reach? List every control, network path and credential it holds, and remove what its task does not need.
- Where do its logs live? Keep records the system cannot alter, with independent signals such as physical sensor data alongside its own reporting.
- What stops it, and what happens next? Define the shutdown trigger, the person who can pull it, and the manual mode the facility drops into. Drill that mode.
- What is kept after an incident? Configuration, version and timestamped logs, preserved before anyone starts fixing.
- Who signs the restart? Name the accountable person, the evidence they need, and when an outside reviewer is brought in.
Before any automated system is allowed to act in a critical facility, write down who can stop it, what the facility does without it, and who decides it can run again. If the only evidence for a restart is the system's own report, the decision has been delegated to the thing that failed.
Sources
- NIST, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, news release (Oct. 16, 2026)
- NIST CAISSI, NSA SISC and CISA, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, Version 1.0 (Oct. 2026)
- Kristof, R. (2026). Anthromekagogy: A Research Framework for Human-System Co-Evolution. Working paper.
Cite this article: Authentic Intelligence Research, “Who Decides When a Stopped AI Agent Runs Again?” Authentic Intelligence, October 26, 2026, https://authenticint.com/articles/who-decides-when-a-stopped-ai-agent-runs-again.html.