Agent risk classification
Decide how to classify the deployment's operational risk for internal decisions
When a new agent needs proportionate review and control requirements, this area becomes relevant. For the AI risk and product owner, the concern is specific: a low-risk label is assigned from the model type without considering what the agent can do. The governance implementation design starts from that consequence and follows the relevant evidence through the customer workflow. Classification should follow the deployed use and consequences. Internal risk categories are decision aids; they should not be presented as legal classifications or as a substitute for qualified assessment where regulatory applicability is involved.
Connect the operating question to inspectable evidence
- AI risk and product owner
- Owns the bounded decision and the consequence of acting.
- Intended use
- Defines the starting context for the proposed work.
- Autonomy level
- Exposes the first material uncertainty to examine.
- Review routing recommendation
- Carries unresolved conditions into an accountable next action.
Decision at stake
Decide how to classify the deployment's operational risk for internal decisions
Make the decision explicit
- AI risk and product owner
- A new agent needs proportionate review and control requirements.
- Decision
- How to classify the deployment's operational risk for internal decisions.
- Autonomy level
- Use intended use to establish the relevant starting condition.
For the AI risk and product owner, this becomes relevant when a new agent needs proportionate review and control requirements. The immediate decision is how to classify the deployment’s operational risk for internal decisions. The scope should be narrow enough that the governance owners can identify a meaningful alternative, including continuing the current approach if the available evidence already supports it.
The practical failure to challenge is that a low-risk label is assigned from the model type without considering what the agent can do. That concern gives the work a concrete direction: establish what the relevant boundary should do, inspect how it behaves or would operate, and identify the owner of any gap. It should not be diluted into a broad transformation exercise before the specific question has been answered.
Coverage
Examine autonomy level alongside reversibility
Keep the review distinctions visible
- Autonomy level
- Inspect actions the agent may initiate without a new human decision.
- Reversibility
- Distinguish an undoable record change from an external commitment.
- Exposure and control context
- Interpret consequences alongside affected people and available controls.
Autonomy level
For this scope, autonomy level should be examined alongside intended use. Describe what the agent can propose, prepare, approve, and execute. Classify the actual authority rather than the model’s general capabilities. The proposed rubric should distinguish a read-only use from a workflow that changes records, even when both use the same underlying technology.
Reversibility
For this scope, reversibility should be examined alongside affected people and processes. Inspect the consequences of a wrong action and whether the business can detect and reverse it. Reversibility should include external effects and human correction, not only software rollback. The resulting internal category should explain which consequence requires stronger evidence or review.
Exposure and control context
For this scope, exposure and control context should be examined alongside data and action consequences. Account for affected people, exposure, operating context, and existing controls. A category should record its assumptions and a revisit trigger. Internal classification supports proportional review; it does not determine a legal category or remove the need for qualified applicability assessment where relevant.
Prerequisites
Start with intended use
Give each input a specific job
- Intended use
- Defines the operating boundary.
- Affected people and processes
- Examine reversibility.
- Data and action consequences
- Shows conditions affecting exposure and control context.
- Policy or risk owner
- Confirm access and a reviewer who can resolve gaps.
The starting material is intended use, affected people and processes, and data and action consequences. Review these together rather than assuming one document tells the whole story. A stated rule may differ from a configured behaviour, and a proposed responsibility may not yet have an available owner. Identify those differences before selecting the detailed work.
Participation should include an accountable policy or risk owner, relevant system owners, and qualified legal or domain reviewers when interpretation is needed. The customer should define which information and environments may be used. Synthetic or sanitised examples can support preparation when they preserve the relevant behaviour; if they omit a material dependency, record the limitation and agree how the missing evidence would be obtained.
How the work proceeds
Follow the requirement into an accountable operating practice
Follow the evidence through the work
- Autonomy level
Use intended use to define the decision criteria.
- Reversibility
Inspect affected people and processes and retain observations that challenge the expected result.
- Exposure and control context
Use data and action consequences to identify unresolved conditions and a responsible owner.
- Review routing recommendation
Link the recommendation to its evidence, remaining limits and next validation condition.
Test the classification rubric with contrasting deployments of the same technology. A read-only internal assistant and an agent that changes external records may require different review paths. The proposed assessment should record exposure, reversibility, affected people, and existing controls, then explain why those facts lead to the recommended internal category.
A practical first slice would focus on autonomy level and then follow its consequences into reversibility. Keep exposure and control context visible as a separate review question rather than assuming it is satisfied by the first result. The governance owners should record observations, competing explanations, and changes to the original assumptions. A second reviewer can challenge whether the evidence supports the recommendation and whether an apparently successful example omitted the condition that matters most.
Indicative artefacts
Use review routing recommendation to make the next action explicit
Every artefact needs an operating use
Illustrative working format
- Internal classification rubric
- Boundary — intended use.
- Deployment risk profile
- Findings about reversibility.
- Review routing recommendation
- Action on exposure and control context.
Indicative outputs include internal classification rubric, deployment risk profile, and review routing recommendation. Their form should follow the decision and the customer’s existing operating records. The first should establish the assessed boundary and relevant observations; the second should make material gaps or dependencies inspectable; the third should identify the action, owner, and evidence needed to revisit the decision.
Acceptance should be tested through use: can the responsible owner explain what was examined, identify an unresolved issue, and act on the next step without reconstructing the whole engagement? Findings should preserve counterevidence and limits. A polished document is insufficient if it does not help resolve the customer’s specific question.
Illustrative scenario
Summary becomes reassignment: classification revisit
Examine the constructed decision boundary
Illustrative scenario
- Summary becomes reassignment
An assistant gains permission to change case priority and ownership.
- Authority comparison
Compare the original read-only use with the proposed consequential actions.
- Classification revisit
Require added oversight or evidence when warranted; do not inherit the earlier category.
Consider an illustrative situation in which an assistant moves from summarising cases to changing their priority and assigned owner. This is a constructed example, not a client engagement or an observed Softlander outcome.
For the priority-changing assistant, the illustrative review would compare the old and proposed authority boundaries. The risk owner might require additional oversight or evidence before expansion. The classification should include a revisit trigger so material changes cannot inherit a category assigned to a narrower earlier use.
The useful learning would be the difference between the expected behaviour and the behaviour or responsibility actually demonstrated. If the exercise leaves exposure and control context unresolved, that should remain a named next step. A recommendation to narrow the scope, improve a prerequisite, or hold the decision can be appropriate when the example exposes a material dependency.
Scope and authority
Governance evidence supports decisions within defined professional limits
Keep analytical work separate from decision authority
- Operating requirements and evidence mapping
- Can include internal classification rubric.
- Policy or risk owner
- Authorised policy owners decide; qualified specialists interpret professional requirements.
- Legal conclusions and certification decisions
- Cannot be inferred from deployment risk profile.
This work supports governance preparation and operating evidence. It does not provide legal advice, determine regulatory compliance, award certification, or replace a formal audit. Authorised customer owners retain policy, release, and residual-risk decisions.
Ways to engage
Related engagement scopes
AI Privacy Engineering Review
Trace personal data through your agent workflow. Examine collection, memory, retrieval, tool access and retention against your agreed requirements.
AI Governance Operating System
Make AI oversight part of daily operations. Connect inventories, accountable owners, change decisions and evidence into a workable governance process.
Continue exploring
Related insights and resources
Governing agent decisions
Governance becomes useful when it changes a decision. Connect each agent workflow to an accountable owner, explicit operating conditions, proportionate evidence and a practical route for exceptions and withdrawal.
Protecting agent data and memory
An agent's information footprint extends beyond the conversation. Map the copies, derived records and retrieval paths that influence future actions, then connect each to purpose, access, retention and verifiable handling.
AI agents in legal operations: assistance without invented authority
Legal agents can organize evidence and prepare work, but professional judgement, client authority and verified legal positions cannot be delegated by interface.