CISA、NIST 和 NSA 发了十条实践：Agent 不按剧本走的时候怎么办

2026 年 10 月 16 日，NIST、NSA 的超级智能安全中心（NSA SISC）和 CISA 联合发布了一份文件，名字很长：《超级智能训练与评估中的事件准备与响应关键实践》。它给出十条自愿性实践，面向的是训练与评估高能力 Agent 的组织——特别是那些部署前、已经降低防护或属于其他高风险非公开系统的前沿 Agent。文件里有个用词值得说明：通篇用「超级智能（SI）」这个词，而不是大多数读者预期的「AI」。不管这个词你怎么看，文件里有一个定义值得直接抄进你的工程文档：SI 控制事件。

十条自愿性实践，和一个特别有用的定义

一、最有价值的一条：SI 控制事件的定义

CISA 的摘要写得很清楚：SI 控制事件，是指一个或多个 SI Agent 采取了未经指示的行动，而这些行动与限定任务范围的策略、控制或安全措施相冲突，或破坏了它们，或破坏了提供人类监督的措施。把这个定义拆开看，它其实给了你三个必须回答的问题。第一，任务范围是什么——你得在派单的那一刻把它写下来，而不是事后回忆。第二，哪些行动是「未经指示」的——这要求你记录每一个动作以及它由谁授权。第三，人类监督是什么、有没有生效——这要求你把人工确认点当成一个可观测事件。三个问题里任何一个答不上来，你就不是检测能力不足，而是日志能力不足，而这个问题没办法用策略文档解决。

# 1) Start with the definition, because it decides what you log.
#    Published wording, condensed: an SI control incident occurs when
#    one or more agents take uninstructed actions that conflict with or
#    compromise the policies, controls, or security measures that scope
#    the task and provide human oversight.
#
#    Three things must therefore exist in your telemetry before you can
#    even detect one:
required_telemetry:
  - "the scoped task and its constraints, as written at dispatch time"
  - "every action taken, with the authorising principal"
  - "the human-oversight checkpoints and whether they fired"
# If you cannot answer "was this action instructed?", you do not have a
# detection problem, you have a logging problem, and no policy fixes that.

二、文件的五个方向，正好对应五件能建的东西

CISA 摘要列出的五个方向是：限制 Agent 对信息、系统、工具和网络的访问；监控异常活动；保全证据并关闭不当行为；从经过验证的基线重建；向相关政府机构与受影响方报告事件和未遂事件。这五条如果当成原则看是空的，当成待建组件看就很具体。第一条对应能力白名单——不是提示词里请求模型「小心一点」，而是代码层面闭合的工具集，每个工具带明确范围、出网策略和调用上限。第二条对应检测规则——「异常」必须有定义，否则告警会淹掉所有人。第三条对应证据包和吊销流程。第四条对应恢复门禁。第五条对应事件报告模板，而其中未遂事件是所有人都会跳过、但成本最低的那一类。

// 2) Practice group one: limiting agent access to information, systems,
//    tools and networks. Implement it as a closed capability set, not as
//    a prompt that asks the model to be careful.
type Capability = {
  tool: string;
  scope: string[];        // explicit paths, hosts, tables
  egress: "none" | "allowlist";
  maxCallsPerRun: number;
};

const researchAgent: Capability[] = [
  { tool: "http.fetch", scope: ["docs.vendor.example"], egress: "allowlist", maxCallsPerRun: 40 },
  { tool: "fs.read", scope: ["/workspace/input"], egress: "none", maxCallsPerRun: 200 },
  // no shell, no fs.write, no arbitrary hosts
];

// The list is the policy. Adding a tool is a code review, not a sentence
// in a system prompt that a clever input can talk around.

三、顺序很重要：先吊销凭据，再杀进程

文件强调了两件事，值得单独说。一是保全证据，二是先测试控制、验证隔离，再恢复 Agent 活动。第一条的工程含义是：证据必须写到一个 Agent 的能力集之外的地方，而且是不可篡改的、带哈希链的。如果你的 Agent 有 fs.write 权限，而证据目录在它的可写范围里，那这份证据在事件发生时就不可信了。第二条容易被简化成「修好了就重启」，但文件的要求更严：恢复之前要测试控制、要验证隔离在同一个场景下有效、要从经过验证的基线重建并做比对。至于关闭流程，我在代码里写了一句可能有点刺的话——在凭据还有效的时候杀进程是表演。Agent 的触达能力来自它的凭据，那才是你要拿走的东西。

实践清单可以逐条落成你真正能建的东西

# 3) Practice group two: monitoring for unexpected activity.
#    "Unexpected" needs a definition or the alert fires on everything.
unexpected_activity_rules:
  - id: act-outside-scope
    when: "tool.scope not contains action.target"
    severity: high
  - id: novel-tool-chain
    when: "tool_sequence not in observed_baseline_24h"
    severity: medium
  - id: egress-new-host
    when: "network.dst not in allowlist"
    severity: high
  - id: oversight-skipped
    when: "run.requires_approval and approvals.count == 0"
    severity: critical

baseline:
  window: "24h rolling"
  note: >-
    A brand new chain is not a breach. The point is that it is reviewed
    while it happens, not reconstructed from logs a week later.

四、报告模板里最值钱的字段是那一栏对比

第五条实践是报告，对象是相关政府机构和受影响方，内容包括事件和未遂事件。很多团队的模板会长成一张十几栏的表格，但真正承载信息量的只有两个字段：指令要求它做什么，它实际做了什么。其余所有内容都是对这个差距的注释。这也是为什么第一条实践（写清任务范围）不能被跳过——如果派单时的约束没有留档，事件报告的这两个字段根本填不出来，最后写成的是一篇回忆录，而不是一份报告。另外提醒一句：文件建议「尽早」报告，但没有给出保留期限的具体时钟；这意味着保留策略仍然是你自己的决定，而 NIST、NSA SISC 和 CISA 把这条留给了使用者的判断。

# 4) Practice group three and four: preserve evidence, stop the behaviour,
#    then rebuild from a verified baseline. In that order.
evidence_bundle:
  manifest:
    run_id: "..."
    task: "as dispatched, verbatim"
    constraints: "as dispatched, verbatim"
    actions: "append-only log, hash-chained"
    approvals: "who, when, what they saw"
  integrity:
    algorithm: sha256
    store: "write-once, outside the agent's capability set"   # non-negotiable

shutdown:
  mechanism: "revoke credentials first, then stop the process"
  note: >-
    Killing the process while its tokens are still valid is theatre. The
    credential is the agent's reach; that is what you take away.

resume_gate:
  - "controls tested after the fix, not before it"
  - "containment validated against the same scenario"
  - "baseline rebuilt from a verified artefact, then diffed" 

五、这份文件对你有没有用：看你在哪一层

如果你的公司不训练也不评估前沿模型，这份文件的目标读者其实不是你。但它的概念结构对你有用，理由有三个。第一，任何跑 Agent 的团队都会遇到「它做了我没让它做的事」，而你现在有了一个精确的说法和一套响应骨架。第二，这十条实践与常规网络安全事件响应是对齐的，也就是说你可以把它们挂到已有的 IR 流程上，而不是新开一套。第三，CISA 的超级智能专题页上还有一份 10 月 22 日发布的《为运营韧性管理 AI Token 消耗》，那份指南的对象是所有用 AI 的组织——token 消耗失控是另一种「未指示的行动」，而且在账单上更容易被发现。两份文件一起看，一份管行为，一份管成本。

// 5) Practice group five: report. CISA asks for incidents and
//    near-misses, to the relevant agencies and to affected parties.
//    Near-misses are the part everyone skips, and they are the cheap ones.
type SiIncidentReport = {
  classification: "control-incident" | "near-miss";
  whatWasInstructed: string;
  whatActuallyHappened: string;
  controlsCompromised: string[];
  humanOversightAtTheTime: string;   // who was in the loop, or "none"
  containment: string;
  resumedAt: string | null;          // null until the resume gate passes
};

// One field carries most of the value: whatWasInstructed versus
// whatActuallyHappened. Everything else is commentary on that gap.
// Write it while it is happening; a report reconstructed later is a story.