University of Edinburgh: Specific Guidance on Agentic AI 

This document sets out the University of Edinburgh’s guidance for using agentic AI, explaining what counts as agentic, what ELM can and cannot do, and how to experiment and deploy these systems safely, securely, and with human oversight

To minimise duplication with general AI guidance, this document applies only to systems meeting the definition of Agentic AI. 

What is Agentic AI? 

Agentic AI refers to autonomous systems capable of executing complex, multi-step tasks, making independent decisions, and interacting with digital environments without continuous, step-by-step human prompting. 

Key Criteria for Identification: 
A system should be treated as "Agentic" under this policy if it exhibits one or more of the following behaviours: 

  • Autonomous Execution: The AI writes code, scripts, or commands and executes them automatically (locally or remotely) without explicit human approval for each step. 
  • Environment Interaction: The AI interacts with software interfaces, APIs, or web browsers as if it were a human user (e.g., navigating menus, clicking buttons, filling forms) rather than simply generating text for a human to copy-paste. 
  • Multi-Step Planning: The system breaks a high-level goal into sub-tasks, executes them sequentially, and self-corrects based on intermediate outputs without human intervention. 
  • Tool Use: The AI dynamically selects and uses external tools (calculators, search engines, code interpreters, database connectors) to achieve a goal. 

What is NOT Agentic AI (Covered by General Guidance): 

  • Standard chatbots where the human must copy/paste every output. 
  • Systems that generate code but require the human to manually run, test, and debug it. 
  • Single-step image or text generation tools. 

The University recognises that staff and researchers will experiment with agentic workflows. While ELM (elm.edina.ac.uk) is the mandatory secure environment for all University AI tasks, it is important to understand its current capabilities and limitations regarding "agentic" features. 

A. Current ELM Capabilities for Agentic Workflows 

ELM provides a secure boundary with Zero Data Retention agreements and UK-based infrastructure. Users can leverage the following features for semi-autonomous tasks: 

  • File-Based Context & Analysis: Users can upload PDF, DOCX, and CSV files via the Tools button. ELM can analyse these documents, extract data, and synthesise information across multiple files. 
  • Image Query & Analysis: Users can upload screenshots or photographs. ELM can identify elements, extract text (OCR), troubleshoot interface issues, or generate alt text. This is a powerful tool for visual reasoning tasks. 
  • Code Generation & Explanation: ELM can generate, explain, and debug code snippets. However, ELM does not currently execute code in a live, persistent sandbox environment for complex, multi-step autonomous loops. The user must copy, test, and run code locally or in approved development environments. 
  • Custom Prompts: Users can create and save custom prompts via the Prompts tool to standardise workflows, effectively creating a "template" for human-in-the-loop processes. 

B. Current Limitations: What ELM Cannot Yet Do 

Staff must be aware that ELM does not currently support the following advanced agentic features often seen in commercial, non-compliant tools: 

  • No Dynamic "Skills" Files: ELM does not currently support the upload or execution of external "skills files" (e.g., JSON/YAML definitions that dynamically grant the AI new tool permissions or complex workflow logic). Users cannot currently "orchestrate" agents by uploading custom skill modules. 
  • No Autonomous Browser Navigation: ELM cannot log into websites, click buttons, or navigate the live web autonomously. It cannot act as a "browser agent." 
  • No Direct API Integration: ELM cannot directly connect to external APIs (e.g., University HR systems, library databases, or third-party services) to fetch real-time data or trigger actions without human intervention. 
  • No Persistent Memory Across Sessions: While chat history is saved, ELM does not possess long-term memory that persists across different chat sessions to learn from past interactions automatically. 

C. Safe Workarounds for Experimentation 

Given these limitations, staff wishing to experiment with agentic concepts should adopt the following Human-in-the-Loop workflows within ELM: 

1. Plan in ELM, Execute Locally: Use ELM to generate the plan, write the code, and define the steps. The human user then executes the code in a secure, local development environment or approved university sandbox. 

2. Iterative Prompting: Instead of a single autonomous agent, use a chain of custom prompts in ELM to simulate multi-step workflows (e.g., Prompt A generates code -> User runs code -> Prompt B analyses the output -> User verifies). 

3. Visual Troubleshooting: Use the image upload feature to screenshot error logs or code interfaces, allowing ELM to diagnose issues and suggest fixes, which the user then implements. 

Warning: Do not attempt to bypass these limitations by connecting ELM to unofficial scripts or external wrappers that attempt to automate interactions. Such actions violate the Computing Acceptable Use Policy. 


While general AI guidance covers accuracy and bias, Agentic AI introduces unique risks regarding autonomy, system access, and resource consumption. The following provisions apply exclusively to agentic deployments (whether using ELM or other approved tools): 

  3.1. Authentication and System Access (Strict Prohibition) 

  • The "No Login" Rule: Agentic AI must never log in to University systems. Automation of workflows must be achieved via approved APIs using service accounts managed by Information Services, not personal credentials. 
  • Rationale: Granting autonomous agents access to authenticated sessions bypasses security controls (like MFA) and creates a high risk of lateral movement if the agent is compromised. 

  3.2. Decision-Making Authority 

  • Human-in-the-Loop Mandatory: Agentic AI must not be used to make final decisions on matters affecting staff employment matters (including staff recruitment and staff discipline), student admissions, student conduct, grading, financial disbursements, or research ethics without explicit, documented human review and approval. 
  • Accountability: A named staff member must remain accountable for every action taken by an agent. The "human-on-the-loop" principle is mandatory; the human must verify outputs before they are acted upon or published. 

  3.3. Resource Management 

  • Compute and Network Limits: Agents must be configured to prevent excessive consumption of shared IT resources. Unsupervised agents can enter infinite loops or spawn excessive processes, degrading performance for other users. 
  • Requirement: Monitor agent activity logs regularly to ensure resource usage remains within acceptable bounds. 

  3.4. Security Mitigations for Autonomous Systems 

  • Prompt Injection Defence: Agents are highly vulnerable to inputs designed to override safety protocols. Deploy agents only within ELM or sanctioned cloud instances with strict firewall rules. 
  • Least Privilege: Configure agents to access only the specific data files or API endpoints absolutely necessary for the immediate task. 
  • Audit Trails: Unlike standard chat, agentic workflows must be documented with: 
  • The specific model/version used. 
  • The prompt strategy and parameters. 
  • Logs of all automated actions taken. 
  • Records of human verification steps. 

  3.5. Data Protection (GDPR) Specifics 

  • Mandatory DPIA: A Data Protection Impact Assessment (DPIA) is mandatory before deploying any agentic system that processes personal data, due to the increased risk of unintended data collection or processing loops. 
  • Data Minimisation: Agents must be technically constrained to process only the minimum data required. Bulk uploading of personal datasets to external agents is prohibited. 
  • Accountability: The staff member deploying or using the agent remains responsible for ensuring that the University complies with its obligations as Data Controller. 

For staff involved in technical development, the University supports participation in the Applied Agentic AI programme (delivered by CodeBase in partnership with the Business School) to stay updated on emerging tools and safe implementation strategies. 

Key Resources: 

  • Digital Skills Programme: Training on AI literacy and responsible use.

 

Note: This guidance should be read in conjunction with the University Computing Acceptable Use Policy, Data Protection Policy, and Research Misconduct Policy. As ELM's capabilities evolve (e.g., future support for skills files or API integrations), this document will be updated. 

  

This article was published on