Risk Management

Agent Management provides a structured workflow for identifying, assessing, mitigating, and approving risks associated with an agent. Risk assessment is independent of operational metrics: an agent can respond successfully while its risk assessment is incomplete or contains significant unmitigated risk.

Associating risks

Open the agent Risk tab and associate one or more risks from the configured risk taxonomy. The default taxonomy organizes risks into categories such as:

  • Operational reliability

  • Autonomy and scope control

  • Security and adversarial robustness

  • Compliance and legal exposure

  • Harm and output safety

Administrators can extend the taxonomy with organization-specific categories, risks, and controls in Settings > Risk taxonomy.

Assessing a risk

For each associated risk:

  1. Score the inherent likelihood and impact.

  2. Review the controls associated with the risk.

  3. Record the implementation status of each control or mitigation.

  4. Attach or reference supporting evidence.

  5. Review the resulting open control gaps and mitigation coverage.

Likelihood and impact use a five-level scale. Their combination places the assessment in the risk matrix. Mitigation coverage summarizes the implementation state of the associated controls; it does not replace the likelihood and impact assessment.

Sign-off

Complete the assessment and submit it for sign-off according to the organization’s governance process. The agent inventory identifies agents that are signed off and agents with a pending assessment. Users need the appropriate risk-management permission to edit assessments or approve them.

Portfolio risk

The portfolio Risk page aggregates:

  • Number of assessed agents and risk types.

  • Overall mitigation coverage.

  • Open control gaps.

  • A likelihood-and-impact risk matrix.

  • Agent-risk associations and their assessment status.

  • Risk-category distribution.

  • Exposure and mitigation by risk or by agent.

Use the portfolio view to identify common control gaps and shared risks across platforms. Open the agent assessment to review evidence and make agent-specific decisions.