Agentic RAG for Australian Government
What agentic RAG is, how it differs from classic RAG, and how it maps onto DTA policy, the Agentic AI addendum and Australian assurance obligations.
Jake Tracey3 August 2026AIGovernmentSecurity
Search "agentic RAG government" from an Australian desk and you get the UK Government Digital Service, an American vendor definition, and a product page. All useful. None of it written from inside the obligations an Australian agency actually carries.
That gap matters, because the Australian rules for this specific class of system already exist. The Digital Transformation Agency published an Agentic AI addendum to its AI technical standard, last updated 4 June 2026. The Australian Signals Directorate co-authored Careful adoption of agentic AI services with its Five Eyes counterparts on 1 May 2026. Version 2.0 of the Policy for the responsible use of AI in government took effect on 15 December 2025.
This is the hub page for how those instruments land on a real build. It links out to five deeper pieces on the parts that decide whether a system ships.
RAG in one paragraph
Retrieval augmented generation makes your own content available to a language model at query time. GDS describes the mechanics plainly in AI Insights: Agentic RAG: documents are sliced into chunks, chunks are converted into embeddings, embeddings go into a vector database optimised for similarity search, and matching results are added to the prompt sent to the model. One query in, one answer out. That is the pattern most agencies are running today, and it is covered in more depth in our guide to RAG for government agencies.
What makes it agentic
Agentic RAG replaces the single pass with a loop. GDS puts it as the system being able to "plan, reflect and iterate over the data, and integrate retrieval updates until it is satisfied". The agent drafts, notices a gap, issues a narrower follow-up query, retrieves again, and revises. It stops when it judges the work complete, not when the pipeline ends.
The DTA addendum defines agentic AI as a class of coordinated agents running a multi-step perceive, reason and act cycle that "executes a series of actions independently to achieve predefined objectives within defined permissions and constraints". Its example agent types include a researcher agent that finds and summarises authoritative information from enterprise search, knowledge bases and document stores "to ground outputs using augmented-generation approach, such as RAG or CAG". Retrieval is not a fringe pattern in that document. Its account of how agents work names RAG and context augmented generation as the way agents ground decisions in enterprise knowledge stores.
| Dimension | Classic RAG | Agentic RAG |
|---|---|---|
| Retrieval | One query, one pass | Multiple queries, planned and revised by the model |
| Control flow | Fixed pipeline you wrote | Model chooses the next step within guardrails |
| Stopping | Ends when generation ends | Requires explicit termination criteria |
| Cost and latency | Predictable, low | Variable, materially higher |
| Typical failure | Missing or irrelevant context | Loops, goal drift, compounding bias across iterations |
| Audit surface | Prompt plus cited sources | Every plan, tool call, retrieval and revision |
| Australian assurance load | AI technical standard | AI technical standard plus Agentic AI addendum |
GDS is also honest about the trade. Traditional RAG is simple, fast and cheap because it issues one query to one retrieval component. Agentic RAG takes longer, costs more to run, and is harder to debug. Their conclusion is that it is an instrument for problems classic RAG cannot solve, not a default upgrade. We agree, and most of the agency conversations we have start with a use case that does not need the loop at all.
The instruments you are actually accountable to
| Instrument | Issued by | Applies to |
|---|---|---|
| Policy for the responsible use of AI in government v2.0, effective 15 Dec 2025 | DTA | Non-corporate Commonwealth entities, with exceptions |
| Technical standard for government's use of artificial intelligence | DTA | Technical specialists and business owners embedding AI in government systems |
| Agentic AI addendum | DTA | Anything with agentic behaviour, applied alongside the standard |
| National framework for the assurance of AI in government | Data and Digital Ministers, 21 Jun 2024 | All Australian jurisdictions, principles-based |
| Careful adoption of agentic AI services | ASD ACSC with CISA, NSA, Cyber Centre, NCSC-NZ, NCSC-UK | Anyone designing, deploying or operating agentic AI |
| Guidance on privacy and the use of commercially available AI products | OAIC | Organisations and agencies using AI that involves personal information |
Two consequences are worth stating plainly.
First, the Policy is now a register-and-report regime, not a statement of intent. Agencies must designate accountable officials, designate an accountable use case owner for every in-scope use case, maintain an internal use case register and share it with the DTA every six months. New use cases must be assessed at design stage. Existing use cases that have not been assessed must be dealt with by 30 April 2027. Where a use case carries an inherent high-risk rating, it must be reported to the accountable official, governed through a designated board or senior executive, reported to the DTA, and reviewed at least every 12 months. See the AI use case impact assessment requirements for the detail.
Second, ASD sets a ceiling that most vendor pitches quietly ignore. The joint guidance recommends adopting agentic AI "with security in mind, assessing its use and never granting it broad or unrestricted access, especially to sensitive data or critical systems", and adds that "organisations should only use agentic AI for low-risk and non-sensitive tasks". If a supplier proposes an autonomous agent with write access to a case management system, that is the sentence to put in front of them.
What the addendum asks of a retrieval system
The addendum adds statements AGT.1 through AGT.8 across the AI lifecycle stages, on top of everything the base standard already requires. Here is how the ones that bite translate into build decisions on an agentic RAG system.
| Addendum criterion | What it means in the build |
|---|---|
| AGT.1.1 and AGT.1.2, accountability and oversight | A named human is accountable for outcomes even where decisions are autonomous. Oversight must be human-in-the-loop or human-on-the-loop, with escalation paths documented |
| AGT.1.3, explainability | Reasoning is captured and auditable, without exposing personal or sensitive data in the explanation itself |
| AGT.2.1, memory management | Define when memory is used, what may be stored, retention periods, hosting constraints, and audit and purge mechanisms. Capture prompts, inputs and outputs for record-keeping |
| AGT.3.3, guardrails and identity | Each agent gets a unique identity, its own credentials, and only the tools and data it needs. No self-assigned access |
| Data stage and AGT.4.1, readiness and exchange | The addendum opens the data stage by stating agencies must not progress beyond early design or experimental stages unless data quality, governance and security are confirmed and assessed as fit for the level of autonomy. AGT.4.1 then requires classification and sovereignty controls on agent-to-agent exchange |
| AGT.6.1 and AGT.6.4, evaluation | Ground truth evaluation sets, robustness testing against adversarial input, and explicit tests of whether the agent retrieves accurately from memory |
| AGT.7.1, tools and logging | Audit logging and tracing across agents and tools, including every external data retrieval and every human oversight event |
| AGT.8.2, control tower | A central observability layer showing what is running, what it costs, and whether behaviour still matches the approved objective |
The pattern across all of it is the same: an agentic RAG system is only as defensible as its evidence trail. That is the practical reason to be conservative about autonomy. Every extra iteration the agent takes is another thing you must log, evaluate and be able to explain to an accountable official.
The five decisions that determine whether it ships
Retrieval quality before autonomy. An agent that loops over a weak index produces confident nonsense faster. Get single-pass retrieval measurably right first, with a ground truth set you can re-run. Start with RAG for government agencies.
Corpus governance. The addendum treats data readiness as a gate, and the National framework names data governance as a cornerstone of assurance, on the basis that the quality of a model's output is driven by the quality of its data. Most agency corpora contain superseded policy, duplicate drafts and documents nobody owns. That is a knowledge management problem before it is an AI problem: see AI knowledge management in government.
Where inference happens. Every retrieval sends a fragment of your content to a model. Which jurisdiction it lands in, who can subpoena it, and whether it is retained are procurement questions, not implementation details. We cover this in AI data sovereignty for Australian government.
Privilege and injection. ASD's guidance describes the confused deputy pattern in detail: a low-privileged user manipulating a high-privileged agent into actions they could not perform directly, with audit logs that look legitimate. Retrieved documents are untrusted input. Practical controls are in securing AI assistants in government.
Jurisdiction. Commonwealth entities work to the DTA policy. Victorian buyers work to a different stack: the Administrative Guideline for the safe and responsible use of Generative AI in the VPS, OVIC guidance, and the VPS AI Assurance Framework, which Buying for Victoria expects buyers to complete and attach to their procurement plan. Suppliers should read the VPS AI Assurance Framework supplier guide.
AI procurement is where this gets decided
The DTA's Guidance on AI procurement in government runs the Plan, Source and Manage stages and points buyers at model AI and cyber risk clauses covering data ownership, retraining, risk sharing and performance monitoring. The National framework's procurement cornerstone adds the questions that matter most for an agentic system: proof of performance testing across the lifecycle, access to relevant information assets, avoiding vendor lock-in, and whether the supplier can support review and evaluation of outputs after an incident.
Answer those in the contract. Retrofitting them is expensive.
How we build these
Noice runs its AI workloads on AWS Bedrock in ap-southeast-2, Sydney, so inference stays in region. We are a Magnolia Platinum Partner and a Progress reseller, which means we can put retrieval behind a content platform an agency already governs rather than standing up a parallel content store nobody owns. We are currently building the Knowledge Sharing Platform for the Victorian Collaborative Centre for Mental Health and Wellbeing, and we support the National Cancer Screening Register.
Our starting position on most engagements is unglamorous. Fix the corpus. Ship single-pass retrieval with citations. Measure it against a ground truth set. Add autonomy only where a human can point at a task the loop demonstrably does better, and only where the blast radius of a wrong answer is small. That sequence is also the cheapest way to produce the evidence an impact assessment asks for.
If you are scoping this, our AI for government page covers how we run the work. Or read the five pieces above in order. They are written to be read that way.
