The Agentic AI
Risk Framework

The agent takes an action that cannot be undone — sends an email to an external party, initiates a financial transaction, modifies a record in a system of record, publishes a document — based on incorrect reasoning, a misunderstood goal, or an edge case the design did not anticipate. The consequence of an irreversible action cannot be mitigated after the fact; it can only be managed, explained, and compensated for.

This is the highest-severity risk category for enterprise agents because the failure mode is not theoretical — it occurs in every production agent deployment at some frequency. The question is not whether the agent will occasionally take an action that was not intended. It is whether the architecture is designed so that the most consequential actions require human confirmation before execution, and whether the recovery process for the cases that slip through is defined and practiced.

The agent accesses or modifies data, systems, or records beyond what the task requires — either because permissions were scoped too broadly at design time, because a model reasoning error leads the agent to attempt an access it was not intended to have, or because the tool integration was not configured to restrict the agent to the minimum required scope.

Scope violations are high severity because they represent a failure of the trust boundary that the organization placed around the agent. An agent that has write access to the entire CRM when it only needed read access to one record type is a security vulnerability, a governance failure, and a potential privacy breach simultaneously. The organization cannot claim minimum necessary access if the agent's tool permissions were not designed to enforce it.

The agent encounters a situation that requires human judgment and attempts to escalate — but the escalation path does not work as designed. The notification does not reach the named reviewer. The reviewer does not understand what response is required. The timeout period expires with no response and the agent's fallback behaviour was not defined. The agent resumes incorrectly after a human decision is returned.

Escalation path failures are high severity because they represent a situation where the safety mechanism designed to protect against autonomous agent errors has itself failed. A working escalation path is not the absence of risk — it is the backstop that keeps risk at an acceptable level. When the backstop fails, the risk profile of every situation the escalation path was designed to handle increases significantly.

An external input — a document the agent reads, a webpage it retrieves, a tool response it receives — contains instructions that cause the agent to deviate from its defined goal. The agent treats the malicious instruction as a legitimate part of its task and acts on it. In a multi-agent system, a compromised worker agent can inject instructions into the messages it passes to downstream agents, propagating the hijacking through the system.

Prompt injection is not a theoretical risk for enterprise agents that read documents, retrieve web content, or process external data. Any agent that processes untrusted input is vulnerable unless the architecture explicitly separates the agent's goal definition from the content it processes. Organizations that deploy agents to read contracts, emails, or web pages without prompt injection mitigations are deploying a system with a known exploitable vulnerability.

The agent's output quality degrades over time — not through a discrete failure event, but through gradual drift. Model updates change the reasoning behaviour. Data distribution shifts make the agent's training assumptions less applicable. The types of inputs the agent encounters in production differ from the types it was tested against. Each change is individually small; the cumulative effect is an agent that is producing outputs at a quality level significantly below the baseline established at deployment.

Quality degradation is medium severity rather than high because it is gradual rather than acute — the agent does not suddenly fail, so the risk is manageable if the monitoring infrastructure is in place to detect the trend before it becomes a production problem. Without a performance baseline and an output quality tracking mechanism, quality degradation is invisible until a downstream effect makes it obvious.

The organization cannot demonstrate that human oversight was applied to the decisions that required it, cannot identify who is accountable for specific governance obligations, or cannot produce structured evidence of control operation when asked by a regulator, auditor, or board. The accountability gap is typically not created in a single moment — it accumulates as team changes erode informal accountability, as governance logs prove to be insufficiently structured for audit use, and as stewardship assignments that were confirmed at deployment drift as organizational changes are not reflected in governance documentation.

Accountability gaps are medium severity at the point of detection but escalate rapidly when they come to light in an examination context — because the inability to demonstrate governance is often treated as equivalent to the absence of governance, regardless of what actually occurred operationally.