The PCI Security Standards Council released Security Considerations for AI Systems on September 15, 2026, and promoted it again in an October 7 press release. For identity teams, the useful part is how specific it gets about AI agents: scope them with "least agency," name a human owner for their output, and require explicit human approval before an agent acts on cleartext cardholder data.
What happened
PCI SSC published the information supplement on September 15, 2026, according to the Council's blog. It covers AI deployment and use, defending against malicious use of AI, and how existing PCI scoping applies to AI. The October 7 press release was a follow-on announcement. It said the guidance was developed with the Council's Global Executive Assessor Roundtable and Board of Advisors, and Help Net Security summarized the document on October 9.
The guidance is not mandatory. PCI SSC states that where it differs from an official PCI standard, the standard takes precedence. It builds on the Council's earlier AI Principles post, which already called for limited, use-case-specific credentials, logging that traces AI actions to accountable humans, and AI systems that are easy to disable.
According to Help Net Security's summary, the main recommendations are:
- Least agency: decide what each AI system is for, what it may do and what data it may touch before you pick or deploy it. Give it only what its tasks need.
- Accountability and approval: a named person should take formal ownership of what the AI produces. The organization should list the actions that need a human sign-off. When an agent can read cleartext cardholder data, every action on that data should get explicit human approval.
- Monitored autonomy: instead of approving each action, an organization can let a system act under monitoring. It first has to set out what the system may do, when approval is still needed, what conditions shut it down, and how its changes get rolled back.
- Splitting duties across agents: no single AI system should hold sensitive data, talk to the outside world, and take untrusted input at the same time. If a workflow needs all three, give each to a different agent with its own permissions.
- Inventory and shadow AI: maintain an AI inventory and bill of materials covering models, versions, hosting, integrations, and data-use and retention policies. Use technical controls to detect and restrict unapproved AI tools.
- Secrets and data: tokenize or encrypt payment data where possible. Store credentials in a secrets manager so they never appear in code, prompts, model context, responses or logs. Run data-loss prevention separately from the AI system.
- Testing and suppliers: test the safeguards, including adversarially, before broad functional testing. Contracts should bar providers from training on your data and disclose their subcontractors.
Why it matters
Most of this is identity governance under a new name. "Least agency" is least privilege for an actor that picks its own next step. Separating data access, outbound channels and untrusted input works as a segregation-of-duties control: it limits what a prompt-injected agent can reach and where it can send it.
The guidance is advisory, but assessors will read it. When an agent touches the cardholder data environment, expect questions about its identity, its permissions and who approved its actions. Our coverage of Delinea's report showed the gap: only 36% of organizations said they could always trace sensitive AI access to the person who authorized it.
What to check in your environment
- Build the AI inventory. List every model, agent and AI integration in or connected to PCI scope, with version, hosting, integrations, retention and the identity each runs as.
- Assign an owner. Name the person accountable for each agent's output and record them in your identity governance tool.
- Find agents that see cleartext PAN. Swap in tokenized data, or put a human approval step in front of actions on that data.
- Look for the three-way combination. Flag any agent that has sensitive data access, can send data externally, and accepts untrusted input such as email, web content or customer chat. Split those duties across separate identities.
- Document autonomy boundaries. For agents running without per-action approval, write down permitted actions, shutdown triggers and rollback steps. Confirm you can disable the agent's credentials quickly.
- Get secrets out of prompts. Review agent configurations, prompt templates and logs for embedded credentials and move them into your secrets manager.
- Review AI provider contracts for a no-training clause and a subcontractor list.
References
- Help Net Security: PCI SSC calls for human approval of AI agent actions involving cardholder data
- PCI SSC blog: Just Published: Security Considerations for AI Systems
- PCI SSC press release: PCI SSC Publishes Additional Guidance on Securing AI in Payment Environments
- PCI SSC blog: AI Principles: Securing the Use of AI in Payment Environments