Agentic AI governance reference
Agentic AI risk map
Twenty-six risks that autonomous agents bring into an organization. Each one is traced to the trust property it breaks, the governance function that should own it, and the threat class it falls under.
Risks by threat class
- Technical controls also apply
- Mostly governance, few direct controls
- Governance only
No risks match. Clear the search or pick another threat class.
Most of these risks have a technical anchor
Twenty-two of the 26 share controls with work security teams already do, such as access control, input validation, and supply-chain attestation. The gap is usually ownership, not tooling.
Some only governance can close
Regulatory non-compliance, societal harm, and market concentration have no threat class and no control set. They need a policy owner, an impact assessment, and a review cycle.
Cascades are the busiest class
Four risks roll up to cascade and escalation, from misconfiguration to agents coordinating with each other. Isolation, quotas, and change control carry most of the weight there.
Want this mapped to your own agents?
We inventory your agents and non-human identities, place each one on this map, and hand you an owner and a control for every gap.