CISA Wrote Human Oversight Into a Logging Mandate

CISA published the Logging Reference Architecture on August 20, 2026. Eighty pages, TLP:CLEAR, implementing OMB M-26-14. The coverage so far has been about the calendar. Federal civilian agencies file an Agency Logging Plan within 90 days, then mature against a model.

Fine, but that is page one. Section 10 is where CISA does something nobody was expecting from a logging document: it permits AI inside security operations, and then writes down the conditions under which that AI is allowed to operate.

What Section 10 requires

The LRA allows machine learning and language models where telemetry volume defeats manual review. Anomaly detection, alert prioritization, correlation and enrichment, weak-signal discovery, query assistance, timeline reconstruction. Then it puts them in their place. These are “optional enabling methods within the logging architecture, not as substitutes for required telemetry.”

An agency using AI-enabled tooling has to identify, in its Agency Logging Plan:

• the intended security use cases
• the data inputs
• the validation approach
• the human review points
• the fallback procedures
• any authoritative or chain of custody needs that distinguish event records from model-generated scores, summaries, recommendations, and other derived outputs

The last three are the interesting ones. They are not principles in a framework nobody reads. They are required contents of a document going to OMB and CISA with an agency CISO’s name on it.

The boundaries, function by function

Section 10.1 sets limits per capability. Paraphrasing CISA’s table:

Function	The boundary
Continuous event monitoring	Output stays tied to underlying event records, validated detections, and analyst-reviewable rationale
Threat hunting	AI augments analyst hypotheses; searchable sources and normalized records stay accessible
Investigation and response	Material containment, disclosure, legal, privacy, or mission-impacting actions require human review
Forensics	AI must not alter source evidence, replace chain of custody controls, or become the authoritative record
Logging operations	AI supports validation and observability of the logging capability itself

Read the investigation row again. A federal agency has written into a compliance document that a model may do the analysis but a person stands between it and any action that matters. That is not a position paper about AI risk. It is an architectural constraint with a filing deadline attached.

Three reasons this travels further than logging

It is in force. Not a proposed rule waiting on comment adjudication, not multinational guidance hinting at where policy might go. M-26-14 is signed and dated May 22, 2026. The LRA implementing it published August 20. Plans are due around November 18.

It connects to the rest of the AI governance stack. Where these capabilities meet the “high-impact AI” definition in M-25-21, CISA says agencies should inventory, assess and govern them accordingly, documenting use cases, safeguards and oversight. It cites NIST AI RMF 1.0 directly. Security operations AI gets no carve-out. It picks up a second layer of governance.

And CISA invited everyone else in. The guidance is offered to critical infrastructure operators and state and local government as a benchmark. An organization with no federal obligation can adopt the Section 10 boundaries as a defensible standard of care and now has a federal document to point at when someone asks why.

The doctrine reading

The Governed Autonomy Doctrine argues that governance has to move at the speed of execution rather than bookending it, that enforcement has to span systems rather than fragment across them, and that an agent should hold no more authority than its mission requires. Those claims usually get argued from first principles and incident post-mortems. Section 10 is better evidence than either, because CISA arrived at the same place from a completely different direction.

The mapping is close to exact. Humans Retain the Right to Intervene is the investigation and response row, restated as a plan deliverable. The instruction that AI must not become the authoritative record is a claim about what an automated system is permitted to be, which is the ground Agents Are Identities, Not Tools covers, and where Least Agency lives. The demand for analyst-reviewable rationale and a custody split between what happened and what a model said about it is Human Oversight, Audit and Traceability written as an architecture requirement instead of a review checkpoint.

What makes this worth noting is the direction of travel. CISA did not set out to write AI governance. It set out to fix federal logging, worked out that agencies were going to point language models at their telemetry whatever anyone thought about it, and wrote down the conditions that make that survivable. The requirements it landed on are the ones the doctrine derives from agent behavior generally.

A principle reached twice, independently, from opposite starting points, is probably load-bearing.

What to do about it

For agencies the near-term work is unglamorous. Inventory the AI already running in the logging and SOC stack, then write the Section 10 disclosures into the plan. Most organizations will find AI already there. Anomaly detection and alert prioritization shipped inside commercial SIEM and XDR products years ago, whether or not anyone called it AI at procurement time.

For vendors and integrators selling security operations AI into federal environments, your product’s oversight design just became somebody else’s compliance artifact. An agency cannot document human review points your architecture does not expose. It cannot document fallback procedures your product does not support. Expect the questions, and expect them from a CISO who has a November deadline.

For anyone building agentic systems anywhere, Section 10 is two pages of concrete, publicly citable text on what bounded autonomy looks like when a security regulator writes it down. Worth reading in the original.

The LRA is TLP:CLEAR and shareable without restriction. Section 10 starts on page 33 of the published PDF. The maturity model it points to lives in M-26-14, Appendix C.