UiO’s Guidelines for Agentic Artificial Intelligence

Agentic AI is based on language models that themselves evaluate the next step in a chain of actions, often without the same control mechanisms and safeguards found in traditional systems.

This means that, for complex tasks, the model may misinterpret instructions, prioritise “goal achievement” over constraints you have given it, and in practice treat a “no” as a “yes” if it considers that the most appropriate course of action.

Agentic AI may also be influenced by instructions hidden in documents, web pages, or other content it processes—so-called “prompt injections.” This may result in your instructions being overridden by the hidden instructions.

This increases the risk of errors, unintended actions, privacy breaches, and violations of ethical and legal requirements.

Clear guidelines and regulations are therefore necessary to ensure the responsible and secure development, use, and management of agentic AI systems at the University of Oslo.

The provisions of these guidelines apply to everyone and to all use of agentic AI at UiO. This includes employees, students, consultants, and others who use such systems.

Agentic artificial intelligens

Agentic AI refers to systems that:

• can plan or make decisions across multiple steps; and
• can initiate actions or requests in systems, services, or data flows without each step requiring explicit human approval.
• This includes software for “agentic coding” and other agentic AI systems.

Agentic AI systems can perform actions on behalf of users or the organisation, unlike assistive artificial intelligence, which only generates passive content such as text, images, video, or audio.

Assistive artificial intelligence

An AI assistant produces only passive content that must be consumed and, where relevant, turned into action by a human. In other words, assistive AI only provides recommendations, analyses, or suggestions, and does not perform actions in systems on behalf of users or the organisation.

These guidelines do not cover assistive artificial intelligence. For such use, UiO's Guidelines for the Use of AI are sufficient.

Types of agent tools include both standalone agent tools available for download, such as Codex and OpenCode, and agent functionality integrated into third-party tools, such as Microsoft Copilot and Adobe Firefly.

You can access certain downloadable agent tools through Company Portal (Windows) and Managed Software Center (Mac).

At UiO, access to agent tools is currently limited.

• Competence requirements: Users must have sufficient technical and subject-matter competence to understand:
  • which actions the agent can perform;
  • what consequences errors may have;
  • how to roll back or correct errors.
• Secure handling of access keys: When agents are configured with access keys or use access keys for other systems:
  • keys such as API keys and passwords must be handled securely and must never be committed to code or shared through open channels;
  • the key must never be entered directly into the dialogue with the agent;
  • if keys or access credentials are suspected to have been compromised, they must be revoked and replaced immediately.
• Use of approved services: The agent must only be connected to business systems and AI platforms approved for use at UiO, and within the formal framework for data and information classification.

• Competence requirements: Users who configure and operate such agents must have sufficient technical and subject-matter competence to understand:
  • which actions the agent can perform;
  • what consequences errors may have;
  • how to roll back or correct errors, such as restoring courses, content, or forms.
• Clear responsibility: It must be clear which person, role, or unit is responsible for:
  • access management and configuration of the agent;
  • follow-up of errors and unwanted incidents;
  • regular reviews of the agent’s permissions.
• Secure handling of access keys: When agents are configured with access keys or use access keys for other systems:
  • keys such as API keys and passwords must be handled securely and must never be committed to code or shared through open channels;
  • the key must never be entered directly into the dialogue with the agent;
  • if keys or access credentials are suspected to have been compromised, they must be revoked and replaced immediately.
• Limited level of control: Human approval is not required for every individual action, but mechanisms should be in place to detect and correct serious errors. Examples include logs, alerts for mass changes, and the ability to restore or undo actions where supported by the system.
• Use of approved services: The agent must only be connected to business systems and AI platforms approved for use at UiO, and within the formal framework for data and information classification.

Principles for establishing, operating, and using high-risk agentic AI

• The operational mandate must be technically defined and limited.
• Transparency: All actions must be fully logged and auditable.
• Logs must be processed in accordance with UiO’s storage and classification regime.
• Prior approval: Use must be approved in advance by the relevant governing body, such as the process owner.
• Service accounts: AI agents must use dedicated service accounts and dedicated service-account API keys.
• Security: Keys for AI access must be stored securely, rotated regularly, and removed when no longer needed.
• Access management: The responsible system owner must ensure regular reviews of permissions and compliance with the principle of least privilege.
• Training: Users and system owners must receive specific training in the use, risks, and control of such agents.

Exceptions must be explicitly documented and narrowly targeted.

Formal requirements before putting agentic AI into production

Before agentic AI is put into use, the following must be in place:

• A risk and vulnerability assessment
• A defined purpose, function, and set of limitations
• An overview of access rights, data, and impact
• A plan for monitoring and incident management

An approval also requires clearly defined responsibilities and roles. For each agentic AI system, the following must be designated:

• System owner
• Technical owner
• Person responsible for information security
• Subject-matter owner

One person may hold several roles. The system owner has the overall responsibility for ensuring that the AI does not act beyond its approved mandate.

Deviations and audits

Violations may result in:

• Suspension of the system
• Notification of oversight functions