BlueprintPage 38
38GOVERNANCE
Agent Risk Scoring
Risk score is a prioritization lens—not a claim that one number proves an agent is safe.
- Priority
- P1
- Phase
- Phase 2
- Primary owner
- Risk / Product
- Status
- Blueprint
Objective
Risk scoring gives leaders a consistent way to prioritize remediation. The score should reflect inherent capability, data exposure, autonomy, identity assurance, policy coverage, behavior and control maturity—not a mysterious single AI prediction.
What to build
- Inherent factors: destructive tools, financial authority, external communication, sensitive data and production access.
- Control factors: verified identity, least privilege, approvals, sandboxing, DLP and gateway coverage.
- Behavior factors: anomalies, repeated policy violations, unexpected destinations and spend spikes.
- Governance factors: owner, purpose, review status, exceptions and age.
Implementation decisions
- Show score components and allow tenant weighting within safe bounds.
- Separate inherent risk from residual risk after controls.
- Recompute on material changes or significant runtime events.
- Use risk tiers to drive recertification and default policy templates.
Definition of done
- Users can explain why a score changed.
- High-risk agents without required controls appear on remediation dashboard.
- Risk scoring never replaces direct policy for critical actions.
Success metrics
- Critical-risk agent count
- Residual risk trend
- Remediation completion
- Risk score coverage
EXECUTIVE VIEW
Risk score is a prioritization lens—not a claim that one number proves an agent is safe.