The National Security and Intelligence Review Agency says the spy service may have run afoul of the CSIS Act, which can require the director to consult with the deputy minister.