Agentic AI Risk Management: The Risks of AI Agents, the Controls That Reduce Them and a Framework to Run It

Agentic AI risk management is the work of identifying, bounding, testing and monitoring what AI agents can do, because an agent's risk comes less from what it says than from the actions it can take. The main risks are operational errors, security attacks such as injected instructions and tool misuse, data leakage, compliance breaches, third-party and model risk, unclear accountability and vendor concentration. A workable framework inventories every agent, tiers it by impact and autonomy, applies preventive, detective and corrective controls, tests it, watches key risk indicators and keeps a way to stop it.

The stakes are practical. In a release of 26 May 2026, Gartner predicted that by 2027, 40% of enterprises will demote or decommission autonomous agents because of governance gaps that come to light only after production incidents. This guide is for the second-line risk, compliance and platform teams who have to prevent that, and it complements the template material already on this site rather than repeating it.

Why agents need their own risk treatment

A chat assistant produces text that a person reads and acts on. An agent plans, calls tools, reads the results and acts again, often across several systems and sometimes alongside other agents. Three properties change the risk profile. Autonomy removes human checkpoints between a decision and its effect. Tool access sets the blast radius, because an agent can do whatever its permissions allow. Composition lets errors and attacks travel from one step or agent to the next.

The UC Berkeley Center for Long-Term Cybersecurity, in its agentic AI profile of February 2026, recommends governance that scales “with degrees of agency” rather than treating autonomy as a switch, and advises treating sufficiently capable agents as untrusted entities. Singapore’s framework for agentic AI starts in the same place, with bounding the risks upfront through limits on autonomy, tools and data access. The consequence for design is that controls have to sit outside the model, in permissions, approval gates, budgets and monitoring, because an agent cannot be relied on to police itself. The concept of bounded autonomy describes the target state.

Agent risk is also not the same as model risk. A model can score well on every benchmark and still sit inside an agent that has the wrong permissions, trusts a poisoned document or loops on a failing tool. Equally, a weaker model inside tightly bounded tools may be acceptable for a low-impact task. Assessing the model tells you how often it errs; assessing the agent tells you what each error can cost. Both assessments are needed, and the second is the one most organisations have not yet built.

A taxonomy of AI agent risks

The ASI codes refer to the OWASP Top 10 for Agentic Applications, published on 9 December 2025. The security rows are treated in depth in agentic AI security, and the permission design behind several first controls in AI agent permissions.

Frameworks to anchor the programme

No single standard covers agents end to end yet, so most programmes combine several:

• NIST AI Risk Management Framework 1.0 (January 2023). Its four functions, Govern, Map, Measure and Manage, are the structure most other agent guidance reuses. The Generative AI Profile, NIST AI 600-1 of 26 July 2024, lists twelve risks, among them confabulation, information security, human-AI configuration and value chain and component integration, all of which agents amplify. NIST has no agent profile yet: its Center for AI Standards and Innovation launched an AI Agent Standards Initiative in February 2026, and when checked on 6 November 2026 it was still gathering input through a request for information on agent security and a draft concept paper on agent identity and authorisation.
• ISO/IEC 42001:2023 and ISO/IEC 23894:2023. The first is a certifiable AI management system that puts agents under policy, roles, risk assessment, operational control, internal audit and management review; the second gives guidance on managing AI risk. The ISO 42001 explainer covers certification.
• OWASP Top 10 for Agentic Applications for 2026. The ten agent threats used in the taxonomy above, with mitigations such as least agency, meaning no more autonomy than a task needs.
• UC Berkeley CLTC Agentic AI Risk-Management Standards Profile, version 1.0 (February 2026). An extension of the NIST framework that emphasises human control and accountability, system-level risk assessment of tools and multi-agent interaction, continuous monitoring, defence in depth and containment, and transparency.
• Singapore IMDA Model AI Governance Framework for Agentic AI. Launched in January 2026 and updated to version 1.5 on 20 May 2026, it is organised around four dimensions: assess and bound the risks upfront, make humans meaningfully accountable, implement technical controls and processes, and enable end-user responsibility.
• MITRE ATLAS. The knowledge base of adversary tactics and techniques against AI now has an agentic AI filter, with techniques such as AI agent context poisoning and AI agent tool invocation (checked 6 November 2026). It is the natural source for red-team scenarios.
• EU AI Act, Article 9. For high-risk systems, a documented risk management system that runs as a continuous, iterative process across the lifecycle, covers foreseeable misuse, reduces residual risk to an acceptable level and tests against metrics and probabilistic thresholds defined in advance. It applies to Annex III systems from 2 December 2027 and can be combined with risk processes that other EU law already requires; the AI Act’s treatment of agents explains when an agent is high-risk.
• Bank model risk guidance. The US agencies’ SR 26-2 of 17 April 2026 excludes generative and agentic AI models from its scope but tells banks to set governance and controls for them through their own risk practices. The PRA’s SS1/23 applies to all models at UK banks with internal model approval, expects more scrutiny for models that are hard to explain and asks for testing when dynamic models change. Neither gives agents a free pass.

An eight-step operating framework

1. Inventory every agent

Record each agent with its owner, purpose, model and version, tools and their scopes, data sources, autonomy level, the people or systems it acts for and the workflows it belongs to. Include agents embedded in bought software and agents that business teams built without telling anyone, because unregistered agents carry unmanaged risk. Give each agent a lifecycle state, such as proposed, in testing, live with approval, live autonomous or retired, so the inventory also shows which controls should already be in place. Retired agents keep their records, since their logs and approvals may be needed long after they stop running. The AI agent governance framework sets out the governance controls that rest on this inventory.

2. Tier by impact and autonomy

Rate impact by who or what is hurt if the agent gets it wrong: customers, money, regulated decisions, safety or only internal convenience. Rate autonomy on a scale such as Gartner’s four levels from the same May 2026 release: observe, advise, act with approval and act autonomously. An agent that only observes low-impact data sits in the lowest tier; one that acts on customer accounts, even with approval, sits in the highest. The tier decides the minimum controls, the testing depth and the review frequency.

A three-tier scheme is usually enough to start. Tier 1 covers read-only or advisory agents on low-impact work, such as summarising internal policies: registration, scoped data access, logging and a yearly review. Tier 2 covers agents that draft or change records people then check, such as preparing supplier queries: add an evaluation set, approval for every write action and quarterly monitoring reviews. Tier 3 covers agents that touch money, customers, regulated decisions or production systems: add red-teaming before release, value caps inside the tools, a rehearsed stop procedure and second-line sign-off for every autonomy increase. Promotion to a higher autonomy level should require a clean record at the current one.

3. Assess the risks

Work from capabilities, not intentions: for each action the agent’s tools allow, ask what the worst credible outcome is, how likely it is and who would notice. Add scenarios peculiar to agents, such as injected instructions in retrieved content, wrong tool arguments, loops, a supplier’s tool changing behind the scenes and a failure cascading through a chain. Check the regulatory position as part of the same pass. Score each scenario before controls (inherent risk) and again after them (residual risk), and write down why the residual rating is acceptable; a rating with no reasoning behind it gives an auditor nothing to test. The AI risk assessment template provides the questionnaire and scoring.

4. Apply controls in three layers

Preventive controls carry the most weight for high-tier agents, because detection after an irreversible action comes too late.

5. Test before and after every change

Build an evaluation set from real cases with pass thresholds per tier, and rerun it whenever the model, prompt, tools or data sources change. Score more than the final answer: whether the agent chose the right tool with the right arguments, stayed within its scope, escalated when it should have and grounded its output in approved sources. Red-team high-tier agents with scenarios drawn from the OWASP list and MITRE ATLAS: hidden instructions in documents, attempts to call tools outside scope, privilege escalation and attempts to get past the approval step. The method in red-teaming an agent before production covers scenario design and the evidence to keep.

6. Monitor key risk indicators

Useful indicators for agents include the approval override rate, tool error and retry rates, denied permission checks, policy or guardrail violations, escalations to people, steps and cost per task, unusual tool sequences and quality on a fixed evaluation set. Each needs an owner, a threshold and a predefined action; for example, an agent whose override rate passes the agreed limit in a week goes back to approval mode. Set thresholds from a baseline gathered in shadow or advisory mode rather than guessing them, and report indicators by tier so that a noisy low-tier assistant does not hide a drifting high-tier agent. Quality indicators also catch slow degradation, which drift monitoring for private AI describes in detail.

7. Respond and contain

Write the agent incident playbook before the first live action: who can stop the agent, how its credentials and grants are revoked, how a bad change is rolled back, and which notification clocks may start under sector rules, the AI Act or the GDPR. Rehearse it, and keep the evidence of each step. Not every problem needs a full stop: demoting an agent from acting to advising keeps the service running while the cause is found. Preserve the traces of the affected runs before anything is changed, because the root-cause analysis and any regulator will ask for them; for banks and insurers, DORA’s incident rules for AI set the reporting clock.

8. Review on a schedule and on triggers

Review high-tier agents quarterly and lower tiers at least yearly, and always after an incident, a new tool, a model change, an autonomy increase or a change in the law. Feed the results into management review under ISO/IEC 42001. A policy template with a committee charter sets out who signs off, and the twelve-control governance checklist is a quick test of whether the reviews are biting.

Three lines of defence

The Institute of Internal Auditors’ Three Lines Model, its 2020 update of the three lines of defence, maps cleanly onto agents. The first line, agent owners and the platform team, runs the controls and watches the indicators. The second line, risk, compliance and security, sets the risk appetite, the tiering rules and the policy, and challenges the first line’s evidence. The third line, internal audit, gives independent assurance by sampling runs, approvals and incidents from the logs. For agents, the second line should also own the tiering method and the list of actions that always need a person, and it should read the same traces as the first line rather than relying on summaries of them.

Example risk register entries

These rows are illustrative, not drawn from any organisation. The AI risk register template gives the full column set and an Excel layout.

Common mistakes in agent risk programmes

• One rulebook for every agent. Gartner’s May 2026 release argues that uniform governance across agents leads to failure; controls should follow the tier, not a single standard applied to a summariser and a payments agent alike.
• Approval as the only control. Approvers tire and start to click through. Pair approval gates with caps inside the tools, so that a rushed approval still cannot exceed the limit.
• Testing the model, not the agent. A model evaluation says nothing about tool scopes, retrieved content or loops.
• Forgetting embedded agents. Agents inside bought software act on company data too, and they belong in the inventory.
• No exit from the model provider. Concentration risk is cheapest to address before every workflow depends on one API.

Agents that do risk work

A related search, agentic AI for risk management, is about the reverse direction: agents that perform risk and assurance tasks such as control testing, vendor reviews and policy mapping. Those are covered by the risk and assurance agents and the guide to agentic AI for compliance. The framework above applies to them as well; an agent that reads audit evidence and drafts findings is itself a high-impact agent.

How VDF AI fits

VDF AI covers the runtime half of this framework, in VDF AI Cloud or in the customer’s own data centre, private cloud, sovereign cloud or air-gapped network; risk appetite, tiering rules and sign-off remain with the organisation. The AI governance platform registers every agent, Network and model with an owner, a purpose, a risk class and a version, and third-party agents such as Copilot or watsonx agents can be registered under the same layer, which closes the inventory gap in step 1.

For preventive controls, VDF AI Agents assigns tools from an MCP-powered registry with tool-level least-privilege access scoped per agent, autonomy levels set what an agent may do alone, and consequential actions wait at an approval gate for a named person. The permission check tool returns allow or deny with the policy reason and logs the check. For detection, each run leaves an audit log and execution trace, and VDF AI Networks records execution history with provenance and per-node cost, latency, token and energy figures, which feed indicators such as cost per task.

For correction, a kill switch stops an agent, a Network or a model, Networks add retry with backoff, circuit breakers and fallback routing, and the Vault keeps a cryptographically durable record of every execution, with decision receipts that bind prompt, sources, model, tools and outcome for the third line to sample. Controls are mapped to the EU AI Act, DORA, NIS2, GDPR and ISO 42001, which means the platform supports those frameworks; the governance and security handbook lists the controls in one place.