Risk Assessment for AI Agent Execution

Observational Risk. Monitoring and reporting only; no transactional or executive authority. Examples: Spend Dashboards, Budget Alerts, Compliance Logs.

Assisted Execution. Human-in-the-loop required; agent drafts, proposes, or initiates but a person must approve before any action completes. Examples: Draft Purchase Orders, Requisition Submission, Anomaly Flagging.

Unattended Execution. No human-in-the-loop. Agent is authorized to commit capital or execute legally binding contracts. Examples: Autonomous PO Generation, Payment Initiation, Contract Execution.

Agents are deployed ad hoc; no centralized visibility.

Centrally listed, but lacks real-time updates or identity verification.

Documented owner, purpose, and authority limits for all production agents.

Each agent is bound to a verifiable credential (Decentralized Identifier, service principal, or signed manifest).

Automated Shadow AI discovery and continuous behavioral trust scoring.

Agents execute all authorized actions autonomously without secondary review.

Limits are defined in natural-language instructions (system prompts); no programmatic enforcement layer.

Approval thresholds are enforced within the application code or middleware frameworks.

Externalized policy enforcement (e.g., Open Policy Agent, Cedar) evaluates every action against corporate governance rules before execution.

Quorum (multi-sig) approval required for critical actions; privilege rings isolate high-risk operations from the core environment.

No persistent logging or session transcripts only; data is lost after execution.

Partial capture of agent actions; logs are not centralized and lack a formal retention policy.

All tool-calls, inputs, and outputs logged to a central repository with at least 12-month retention.

Policy decisions and execution logs stored in Write-Once-Read-Many (WORM) or append-only ledgers.

Digitally signed evidence files with hash-chained integrity, verifiable via the Agent Governance Toolkit or independent audit tools.

Reliance on general IT runbooks; no specific documentation for agent failure modes or prompt injection.

Written procedures exist for agent termination, but have not been formally tested or exercised.

Agent-specific failure modes (e.g., recursive loops, authority breach) exercised via tabletop in the last 12 months.

Real-time monitoring triggers automated kill-switches or circuit breakers; response protocols tested semi-annually.

Service Level Objectives and error budgets applied to agent behavior; chaos engineering utilized to simulate and harden against autonomous failure modes.

Third-party models and plugins are integrated without legal or technical risk assessment.

Standard procurement review completed, but lacks specific clauses for AI output or autonomous execution risk.

Indemnity and liability caps for model output and agent failure specifically negotiated in Master Service Agreements (MSAs).

Plugin manifests are cryptographically signed; contracts include specific performance warranties and uptime requirements for agentic workflows.

Only cryptographically verified plugins with pre-audited Service Level Agreements are permitted in production; capabilities are gated by the plugin’s trust score.

Covers financial loss from professional negligence or the failure of technology products to perform as intended.

Covers data breaches, network security failures, and privacy liability; typically focused on unauthorized external access rather than autonomous agent logic.

Protects against third-party claims for bodily injury and property damage arising from business operations or products.

Protects leadership against claims of “wrongful acts,” including breach of fiduciary duty or mismanagement of corporate assets.

Protects against claims of wrongful termination, discrimination, or harassment.

I have identified specific exclusion endorsements or narrowed coverage definitions in recent quotes.

I haven’t performed a detailed review of 2026 endorsement changes or “Silent AI” language.