AGRisk domain
AI agents
AI agents covers the non-human half of the workforce: AI agents and service identities, the scopes they hold, the logs they write, their lifecycle from approval to retirement, and the people who own them. An agent fails in three ways: it is granted too much, it runs unwatched, or its owner is compromised. The domain scores the agent and its owner together, because the owner's approvals, scoping and retirement decisions are human behavior.
Classification
- Dimensions Every signal answers one of 3 questions.
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- ID.AM-02
- PR.AA-01
- PR.AA-05
- DE.CM-01
- GV.RR-04 · NIST AI RMF Govern
- Manage
- MITRE ATT&CK
-
- TA0003 Persistence, TA0004 Privilege Escalation · T1078.004, T1528, T1562.008 · ATLAS AML.T0048
Agents hold standing access, run around the clock and exercise no judgment, so a mis-scoped agent fails faster and wider than a person. The NIST AI Risk Management Framework and ISO/IEC 42001 both call for accountable owners and lifecycle control over AI systems, and this domain is where those requirements become measurable.
Three dimensions in ai agents.
- Threat1 signals
- Threat is an agent's credentials or tokens exposed, since a leaked secret turns a service identity into an attacker's identity.
- Access2 signals
- Access is what an agent can reach (broad or standing permissions) and who owns agents or service identities, since the owner's account inherits the agent's reach.
- Behavior6 signals
- Behavior covers both halves: an agent launched without approval, running without logging or acting outside its assigned role on the risky side; an agent registered with a named owner and retired after its task on the vigilant side.
Signals
9 signalsScroll sideways to see every column.
| ID | Signal | Dimension | Polarity | Source |
|---|---|---|---|---|
| AG-A-01 | Owns AI agents or service identities | Access | Neutral | IGA |
| AG-B-01 | Grants agents broad or standing permissions | Behavior | Risky | IGA |
| AG-B-02 | Registers agents with a named owner | Behavior | Vigilant | IGA |
| AG-A-02 | Agent holds broad or standing permissions | Access | Neutral | IGA |
| AG-T-01 | Agent credentials or tokens exposed | Threat | Neutral | EXPO |
| AG-B-03 | Launches an agent without approval | Behavior | Risky | IGA |
| AG-B-04 | Agent runs without logging enabled | Behavior | Risky | SIEM |
| AG-B-05 | Agent acts outside its assigned role | Behavior | Risky | SIEM |
| AG-B-06 | Terminates an agent after its task completes | Behavior | Vigilant | IGA |
Headline metrics and grade bands
4 metricsA to F bands for the numbers a program reports in this domain. Bands marked "framework benchmark" are authored targets until the HRM Benchmark publishes measured values.
Scroll sideways to see every band.
| Metric | Unit | A | B | C | D | Anchor |
|---|---|---|---|---|---|---|
| M-AG-1Agents with a known, current owner | % of AI agents and service identities | ≥ 100 | ≥ 95 | ≥ 85 | ≥ 60 | NIST AI RMF; CSF ID.AM-02 |
| M-AG-2Agents on least-privilege scopes | % of agents without broad or standing permissions | ≥ 95 | ≥ 85 | ≥ 70 | ≥ 50 | Framework benchmark; CSF PR.AA-05 |
| M-AG-3Agents running without logging | % of active agents with audit logging off | ≤ 0 | ≤ 2 | ≤ 5 | ≤ 15 | Framework benchmark; CSF DE.CM-01 |
| M-AG-4Agents retired on schedule | % of completed-task agents terminated within 7 days | ≥ 95 | ≥ 85 | ≥ 70 | ≥ 50 | Framework benchmark |
Indicator library
17 indicators- I.0465Attempts to override AI guardrails
- I.0466Launches AI agents without approval
- I.0467Runs privileged AI workflows without logging
- I.0468Grants AI agents excessive permissions
- I.0469Grants AI agents unnecessary write access
- I.0470Configures AI agents to bypass safeguards
- I.0471Manipulates AI models to bias outputs
- I.0472Leaves unmonitored AI agents in production
- I.0473Schedules autonomous AI tasks without review
- I.0474Disables AI workflow logging
- I.0475Uses AI agents outside role authority
- I.0476Reports unsafe AI agent behavior
- I.0477Configures AI agents with least privilege
- I.0478Reviews AI agent logs regularly
- I.0479Seeks approval before launching autonomous AI workflows
- I.0480Enables real-time alerts for sensitive AI actions
- I.0481Terminates AI agents after task completion
Cohorts in this domain
2"AI agents" (AG), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/domains/ai-agents
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.