The Intelligence Community has decided AI agents are coming. It has not decided how they will be supervised, checked and held to analytic standards. In April, CIA Deputy Director Michael Ellis said analysts will soon work alongside AI “coworkers” that draft key judgments and check them against tradecraft standards, and that within a decade officers will manage teams of AI agents. In August, DIA’s Chief AI Officer, MG Robert Kinney described this path as “building agents, and then agents with agents.”
The direction is set. What is missing is the discipline for managing it. Building one capable agent is now an engineering problem that industry has largely solved. Getting a dozen of them to work together on an intelligence question or targeting or planning issue, without losing the sourcing, the dissent and the accountability that underpin intelligence work, is a tradecraft problem.
That discipline has a name in industry: orchestration. It means deciding which agent does what, what each is allowed to touch, how their work is checked, and where and when a human must decide. For intelligence, orchestration is not a technical detail to leave to vendors. It is where analytic integrity will be won or lost.
The future of the US Intelligence Community is likely to involve networks of AI agents working amongst themselves — exchanging information, coordinating tasks and providing actionable intelligence. “Building agents, and then agents with agents, is the direction that we want to go,” Kinney said during an AI panel at DIA’s DODIIS conference in August. Kinney envisioned an AI agent that supports intelligence functions communicating with multiple other agents supporting operations, fires, logistics, communications and planning, creating an interconnected system able to help reason through complex mission problems.
Why Orchestration is the Hard Part
Anyone who has run analytic production or targeting knows the failure modes, because people have them too. With agents, they arrive faster and at greater scale.
Errors compound. When one agent’s output becomes the next agent’s input, a small mistake early in the chain can harden into a confident conclusion at the end. A human manager catches this by asking, “How do we know that?” An orchestration system has to ask the same question at every handoff.
Sourcing gets lost. Intelligence consumers trust a judgment because they can trace it to its reporting. When five agents summarize, reformat and combine material, the link between a claim and its source can quietly disappear. A judgment without provenance is an opinion.
Dissent disappears. Agents built on similar models tend to agree with one another. Without deliberate design, a team of agents produces consensus by default, the very groupthink that structured analytic techniques were created to break.
Accountability blurs. DIA’s chief AI officer highlighted the issue: no one yet knows what good tradecraft looks like when agents work with other agents. If a flawed assessment reaches a policymaker, or a flawed target package reaches a commander, someone must be able to say which agent produced which step, on what evidence, and who approved it. In April, NSA and its Five Eyes partners warned that opaque agentic systems make exactly this kind of audit hard.
What Good Orchestration Looks Like
The good news is that the Community does not have to invent the answer from scratch. Our own analytic standards, and a few early commercial systems, point the way. We also have organizations who have the authority to lay out the policy, the Office of the Director of National Intelligence (ODNI) and the Undersecretary for Intelligence and Security in the Office of the Secretary of War (OUSW I&S). In developing the policy, the DNI, with OUSWI&S should focus on the following:
Build in the audit trail. Every agent action should be logged and traceable to its evidence, the way a source citation anchors a finished product. Blockchain intelligence firm TRM Labs calls its investigative agent a “glass box”: it suggests and explains, never changes a case on its own, and every finding traces back to the underlying data. That is the right instinct for intelligence work.
Give each agent only what it needs. The Five Eyes guidance warns that over-privileged agents magnify the damage from a single compromise. The same principle improves analysis. TRM reports that its internal orchestrator holds 56 tools but shows each agent only the eight or so relevant to its task, and that narrower choices produce better decisions. Need-to-know works for machines, too.
Write the analytic standards into the system. ICD 203 already tells us what good analysis requires: sourcing, expressed uncertainty, alternative views, logical argument. The supervising layer should check every draft against those standards before a human sees it, as Ellis described.
Design for dissent. Assign an agent the job of the red team, or the devil’s advocate, and require the orchestrator to carry its view forward rather than average it away.
Put humans at the decision points, not every step. People should approve anything irreversible or consequential, such as a published judgment, a final target package, a dissemination or an operational recommendation. Asking a person to rubber-stamp every machine step is not oversight. It is fatigue.
The Hardest Test: Targeting
Nowhere does orchestration matter more than in the joint targeting cycle, where intelligence becomes action. This year showed both the promise and the risk of AI in the targeting cycle. During the Iran campaign, the Maven Smart System helped U.S. forces strike more than 13,000 targets in 38 days, regenerating target lists in minutes after each round of damage assessment. Public reporting has also tied the February 28 strike on the Shajareh Tayyebeh school, which killed more than 170 people, to outdated intelligence on AI-generated target lists. Speed without discipline turns a stale fact into a tragedy.
DOW Joint doctrine already separates the jobs that keep targeting accurate and lawful: developing the target, vetting the intelligence, checking no-strike lists, estimating collateral damage and the commander’s decision. Orchestration should preserve that separation, not collapse it into a single system. One agent’s only job should be to flag intelligence that is aging or contradicted by newer reporting. The agent that vets a target should be independent of the one that builds the case, so no agent grades its own work. Every element of a target package should trace to its source and date. And assessment results should automatically recheck every package built on the same intelligence, not just refresh the list.
Validation, legal review and the commander’s decision must stay human, with enough time and visibility to make real decisions rather than clicks. In targeting, orchestration is not mainly about going faster. It is about making sure the safeguards scale with the speed.
Building AI to Fight Back
The Community can build on its own analytic standards and a few early commercial systems. AI technology that arms adversaries, also gives defenders a way to at least match their scale. For example, TRM Labs is defining a new category of work called AI investigations; their platform which performs this is called Ardence. As described above, this brings blockchain intelligence together with data from dozens of partners, including CACI DarkBlue, Flashpoint, Team Cymru, Magnet Forensics and ShadowDragon, so investigators or analysts can see their critical data in one platform and work a single unified investigation or target. Under the analyst’s direction, Ardence searches all those sources in parallel. Every finding traces back to its source record, and the analyst decides what happens next. This moves analysts from individual leads and disjointed targeting lines to coordinated disruption at the speed and scale today's threats demand. It can be done but the IC needs to set the policy so it is secure in the Agents’ findings.
What Leaders Should Do Now
First, ODNI and I&S should treat AI orchestration as tradecraft. That means issuing Community-wide standards for multi-agent analysis, much as ICD 203 did for human analysis, covering what must be logged, how provenance is preserved, how dissent is carried, and where human approval is mandatory.
Second, test the orchestration as well as the model. Evaluations today focus on whether a model answers correctly. The Community also needs to test how teams of agents fail, including how errors propagate, whether sourcing survives, and whether a planted contrary fact gets surfaced or buried.
Third, buy for transparency. Agencies should write audit trails, provenance and human approval gates into contracts, and choose orchestration layers they can inspect. Ellis was right that the CIA "cannot allow the whims of a single company" to constrain it. The orchestration layer is where that dependence would be hardest to unwind.
Fourth, train the managers. Tomorrow's analysts will spend less time drafting and more time supervising agents, judging their work and owning the result. That skill set resembles running an analytic team and needs its own training and career path.
The remaining open question is how far the government should allow agents to operate without human intervention. Kinney suggested the answer will depend on the consequences of a decision. In potentially reversible mission areas, agencies could accept more risk and keep a human "on the loop," while irreversible actions such as fires would require a human "in the loop."
The Bottom Line
I spent more than four decades watching the Community absorb new collection systems and new analytic tools, and the management discipline around each one determined its success. AI agents will follow the same pattern. The agencies that get orchestration right will produce faster intelligence that policymakers can trust. The agencies that miss will produce faster intelligence that no one can defend. The time to write the rules for the intelligence community is now, before the agents start managing agents on their own.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
