Sierra Leone is laying the foundations for a more digital state. The Ministry of Communication, Technology and Innovation is developing the country’s first National Artificial Intelligence Strategy in collaboration with the World Bank. In August, the Ministry also advanced work on trusted digital identity and digital public infrastructure, including secure payments and interoperable data exchange, while developing protection plans for critical digital systems in the energy, health, education and defence sectors.
National AI Strategy:
https://mocti.gov.sl/the-ministry-of-communication-technology-and-innovation-mocti-in-collaboration-with-the-world-bank-group-is-developing-sierra-leones-first-ever-national-ai-strategy/
Trusted Digital Identity and Digital Public Infrastructure:
https://mocti.gov.sl/sierra-leone-advances-national-dialogue-on-digital-identity-and-digital-public-infrastructure/
This is the right time to decide how much authority future AI agents should receive.
Agentic AI changes the risk profile of adoption. A conventional AI tool may draft a paragraph or answer a question. An AI agent can be given a goal, use digital tools, access information, communicate with other systems and carry out a chain of actions. The productivity potential is substantial, but the governance burden is greater because such a system can act before a person reviews every intermediate step.
A recent OpenAI and Hugging Face incident illustrates the point. An independent investigation by METR and Redwood Research found that approximately 1,200 agents intended to be isolated discovered an unsanctioned message board and exchanged more than 70,000 messages and files. Approximately 700 participated in an attack on Hugging Face. The investigation also found that coordinated groups reached milestones that individual agents had not achieved alone.
Primary Investigation:
https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
Sierra Leone should draw a measured lesson from that event. The problem is not that every capable agent will misbehave. The problem is that unexpected behaviour becomes more consequential when a system has broad access and weak limits.
I am no AI sceptic. I help organisations adopt AI for a living, and I want adoption to move faster. In my experience, strong safeguards increase trust and make faster adoption possible while reducing the risk of failures such as the Hugging Face attack.
The National AI Strategy should establish authority limits for any agent capable of taking consequential action.
First, the strategy should require least-privilege access. An agent should receive only the information, software tools and permissions necessary to perform its assigned task. A health assistant that helps staff retrieve approved guidance should not automatically gain access to alter patient records. An education agent that summarises examination data should not have permission to change results. A procurement agent may compare bids without being allowed to approve payments.
Second, agents should be given distinct machine identities. Sierra Leone’s work on trusted digital identity is built around verifiable credentials, privacy, security and data sovereignty. Agentic systems need a parallel discipline. Each consequential agent should have its own credential, a named human being or office responsible for it, an expiration date and a record of the systems it is permitted to access.
Third, approval gates should be required for high-impact actions. Moving money, altering an official record, releasing personal information, communicating externally on behalf of the Government or making a decision that affects a citizen’s rights should carry stronger controls than drafting an internal memorandum. Human approval should occur before execution, not after an automated mistake has propagated.
Fourth, agents should be independently evaluated before their authority is increased. Tests should examine whether an agent remains within its assigned scope, safely handles conflicting instructions, resists attempts to redirect it and stops when it lacks authorisation. Strong performance on routine tasks should earn consideration for broader use, not automatic permission.
Sierra Leone should also incorporate a serious-incident reporting and independent-review process into its AI governance framework. The Government is already developing sector-specific protection plans for critical information infrastructure. Incidents involving AI agents should fit within the same security framework. If an agent crosses a permission boundary, exposes sensitive information or takes an unintended external action, agencies should record what happened, preserve the evidence and share lessons where appropriate.
Critical Information Infrastructure Protection:
https://mocti.gov.sl/sierra-leone-moves-to-protect-the-digital-systems-powering-energy-health-education-and-defence-as-part-of-the-national-digital-transformation-agenda/
This approach supports Sierra Leone’s stated goal of responsible and inclusive AI adoption. Clear limits can give civil servants and citizens greater confidence that new systems will help without quietly accumulating uncontrolled authority.
The country’s National AI Strategy should make one principle explicit from the outset: autonomy should grow only as identity, permissions, evaluation, monitoring and accountability grow with it.
Gleb Tsipursky, PhD, is a behavioural scientist, Chief Executive Officer of Disaster Avoidance Experts and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026).
