Japan is entrusting AI agents to its civil servants and, on the same day, publishing the rules that govern them. The Gennai standard (源内基準, "Gennai kijun"), posted online on 20 October 2026 by the Digital Agency, imposes seven safeguards, including limiting execution rights, human approval for important processing and keeping logs. It sets a condition for access: accepting that responsibility for work done with an agent lies with the administration. The Minister for Digital, Toshiharu Furukawa, sees it as a reference for local authorities and companies considering agents, according to the account of his press conference.
In France, ANSSI (France's national cybersecurity agency) considers that agentic assistants installed on workstations should not be deployed in production. Japan is opening, ministry by ministry, Gennai Agent Chat, which the Agency compares to Claude Cowork, to about 180,000 state personnel. From a single instruction, it chains file reading, web search and drafting. Agent Chat is a state web service, not software installed on the workstation.
The text targets three roles: users, administrators in each ministry, including the AI officer (CAIO), and the Agency's developers. Users are civil servants in state administrations and, if they wish, staff of the Parliament, courts and independent administrative agencies (section 1-1). Fiscal 2026 remains an experiment in all ministries. Use in an established regime is envisaged from fiscal 2027, according to the Agency's presentation. The text was drafted with the help of Japan's AI Safety Institute (AISI), according to the announcement page.
ActuIA has read the text of the standard, published in Japanese (first edition, October 2026), and translates the key passages into French here. The presentation document gives the broad outlines.
Limited rights, approval, logs: the safeguards of section 1-4
Section 1-4 names the risks of agents: "the successive execution of erroneous decisions, the accidental deletion or modification of work files, processing that exceeds the rights granted, the inappropriate handling of confidential information". The measures follow in the same section. Agents are introduced with "limitation of purpose of use and execution rights, confirmation and approval by a civil servant for important processing, keeping logs, a function to suspend use, periodic performance evaluation, review of skills and clarification of the responsible person".
Skills are procedures that an agent executes, written in Japanese in a SKILL.md file according to the Agent Chat guide. They may circulate between ministries, but not "without conditions". Review, quality assessment, security control, version management and withdrawal procedure remain to be organised in Gennai.
Responsibility remains with the administration
The text makes AI a means to support "research, examination, analysis and drafting". The final decision rests with the civil servant. Access to agents has a condition: "understand that responsibility for work done with an AI agent lies with the administrative body". Supplier contracts for agents set the same principle for their customers, ActuIA noted on 5 October.
Section 2-2 prohibits copying an unverified output into an administrative document. Faced with an abnormal output, the user stops the processing and, if necessary, alerts the administrator. They must remain able to do important work without AI. For Agent Chat, section 2-3 adds: "important decisions, administrative processing or external communications must go through the necessary confirmations and approvals". The user checks sources, figures, legal texts and recipients themselves.
Two risk levels, assessed by the user
Section 2-2 knows only two categories. Routine tasks internal to a service are "relatively low risk" and do without excessive procedure. Administrative acts, decisions with external effect and public policy choices weigh on citizens' rights or the running of the administration. They call for approval by the user, verification of accuracy and security, enhanced logs.
The user "must determine the risk level", with an assessment sheet to support. If they judge high risk likely, they document risks and countermeasures, then report to the CAIO. Section 1-4 also asks ministries to supervise skills used for authorisations, benefits, unfavourable decisions and recruitment.
The register of these uses is only a project. The text plans to study a function imposing, "for certain high-risk tasks", an AI use register "distinct from ordinary access logs". A suggested track: record entries, prompts, data consulted, response, model and time.
What must not enter Gennai
Gennai relies on cloud services registered with ISMAP, the government programme for evaluating cloud services. At the Digital Agency, it processes information up to confidentiality level 2. Each ministry sets its own rules. Level 3 information, treated as secret documents, "must not be entered into Gennai" (section 1-5). The ban extends to specially designated secrets and economic security information, "regardless of the input method": prompt, attachment or deposit in the personal storage space.
Two rules target individuals. AI must not be used to "infer attributes, such as beliefs, that the person has not expressed, or to predict their future behaviour". Aggregating information from several sources per individual is prohibited. Any unauthorised generative AI service is banned. An output shared in a common folder may become an administrative document, subject to retention rules (section 1-6).
Gennai workshop, on administrator validation
The Gennai workshop, targeted for December 2026, widens the scope. The Agency's presentation calls it "equivalent" to Claude Code, and Agent Chat to Claude Cowork. The standard itself cites Claude Code and Codex as typical examples of coding agents whose use is spreading worldwide in October 2026, for tasks beyond programming. The workshop chains "tens to hundreds of steps" on files, commands and the web.
All sites are in principle open to it, except those developers deem dangerous. Agent Chat, by contrast, only communicates with authorised services. According to the presentation document, the workshop is reserved for civil servants who have passed a literacy check and been validated by their administrator.
According to Japanese media XenoSpectrum, which compares sections 3-5 and 3-6 of the standard in a table, the workshop is disabled by default. It blocks external sends (POST and PUT requests) and allows consultation (GET), recording recipient, volume and time. These rules do not appear in the Agency's presentation documents. In the detailed table of contents of the presentation document, the sub-items of chapter 4 announce the separation of rights and responsibilities, approval of production changes and "immutability of audit trails".
Why the state designs its own environment
When logs and evaluation methods depend on the supplier's specifications, administrators may be unable to verify agent behaviour. Section 1-4 speaks of a "black box". The state therefore designs the agent environment, using market products where they fit.
A Japanese model is not chosen "solely because it is national" (section 1-3). The same section plans to study models whose usual safeguards would be relaxed or lifted. Condition: the necessity of the service. It also envisages cooperation with AISI to evaluate models.
ANSSI bans agentic assistants on workstations from production
In France, CERT-FR, the government alert centre attached to ANSSI, published on 13 April 2026 a bulletin on agentic AI automation products installed on workstations, including OpenClaw and Claude Cowork. According to ANSSI, these products, most in beta, "must under no circumstances be deployed in production environments". It reserves their use for isolated sandboxes, without sensitive data.
Both texts limit agent rights, ANSSI "to the strict minimum". They require human validation: ANSSI as soon as a system command or an action with side effects is envisaged, the standard for "important processing". Both ban unvalidated tools. The Japanese standard, for its part, allows level 2 confidentiality data.
Next milestones: the workshop around December 2026, then Gennai OSS 2.0 around February 2027, a free version of both environments, reusable for commercial purposes. The standard, numbered first edition, provides for a revision history.
Our articles will then appear first in Google Top Stories.