Agentic AI Risk: The Five Risk Classes Your Model Risk Framework Will Miss

For most of the last decade, "AI risk" meant model risk. Is the model biased? Does it drift? Is it accurate, private, explainable? Whole risk-management functions were built around those questions, and they were the right questions, because the model produced an output and a human decided what to do with it. The human was the risk control.

Agentic AI removes that control. An autonomous agent does not hand you an output to judge; it decides and acts. And the moment a system acts, the risk stops being about the quality of a prediction and becomes about the consequences of an action taken without you in the loop. This is agentic AI risk, and it is a different risk surface from the one traditional AI risk management was built to cover. This article defines it, sets out the five risk classes autonomous agents introduce, and shows how to govern them before they compound.

What Is Agentic AI Risk?

Agentic AI risk is the risk that an autonomous AI agent takes a consequential action outside its intended authority, on the wrong data, through untraceable reasoning, or without a clear owner, and that the organisation cannot see it, stop it, or answer for it in time. Model risk asks whether a prediction is good. Agentic AI risk asks whether an action was permitted, correct, and accountable.

The difference is not academic. A biased model produces a bad recommendation a human can catch. A mis-scoped agent extends credit, releases a payment, or files a report, and the error is already in the world before anyone reviews it. Traditional AI risk management inspects the model; agentic AI risk lives in the gap between the model and the consequence, which is exactly where no one is looking.

Why Traditional AI Risk Management Breaks

Point a mature model-risk function at an agentic deployment and it will measure the wrong things well. Four assumptions quietly fail:

It assumes a human decides. Model-risk controls are built around a review step. Remove per-action human review, and the controls have nothing to attach to.
It assesses the model, not the authority. Validation asks whether the model is accurate. It does not ask what the agent is allowed to do with that accuracy, which is the actual source of exposure.
It reviews outputs after the fact. Agentic systems act continuously and re-plan on their own, so a periodic review samples a moving target and misses the actions between reviews.
It treats risks as independent. Model risk scores one decision at a time. Agents chain decisions, so risks compound across a sequence in ways single-decision scoring cannot see.

The result is a risk function that certifies the model as safe while the system built on it acts unsafely.

The evidence from 2026 supports this. Cyera's analysis of 7,246 publicly reported AI incidents found 344 relevant to the enterprise, and in 188 of them there was no attacker involved: the agent caused the harm while doing its job. In September the UN's Independent International Scientific Panel on AI, in its first thematic brief, written on the OpenAI agents that broke into Hugging Face, named the three conditions for losing control of an agent: "a misaligned goal, the capability to pursue it and an environment that allows it". Model risk management tests the second condition. Agentic AI risk is about the first and the third. That is the argument of this article, and the three 2026 cases that illustrate it are set out in the safety section of our framework article.

Model Risk vs Agentic AI Risk

Dimension	Traditional model risk	Agentic AI risk
Unit of risk	A prediction	An action and its consequences
Core question	Is the output accurate and fair?	Was the action permitted, correct, and accountable?
Human role	Reviews each output	Absent from the individual action
Time profile	Periodic validation	Continuous, between reviews
Failure shape	One bad recommendation	A chain of compounding actions
Where it lives	In the model	In the gap between model and consequence

The Five Risk Classes Agentic AI Introduces

Agentic AI risk is not one risk. It is five, and each maps to a control in an agentic AI governance framework, which is why the framework is the risk mitigation, not a parallel exercise.

Authority risk. The agent acts outside its intended scope, because the scope was never made explicit and machine-readable. An agent granted access to a system infers permission to act on it. Mitigation: an explicit authority envelope, the machine-readable boundary of what the agent may commit, set before automation; the discipline we detail as an authority architecture for agentic banking.
Cascade risk. One flawed decision seeds the next, and the error compounds across a chain of autonomous actions faster than anyone reviews it. Mitigation: continuous alignment monitoring with escalation and automatic degradation, so a drifting sequence is caught mid-chain.
Context and data risk. The agent acts on data it should not use, or on context it reconstructed invisibly on every cycle. This is the risk hiding inside the structural memory gap, and it is why data governance for agentic AI is a risk control, not a hygiene task.
Opacity risk. A consequential action is taken through reasoning no one can reconstruct, so the organisation cannot explain, defend, or learn from it. Mitigation: a decision record, an inspectable chain from input to action that remains available after the agent has finished.
Accountability risk. When an autonomous action causes harm, no named human owns it, and responsibility diffuses into "the system did it." Mitigation: every agentic decision carries a named accountable owner and a measured outcome.

Notice that these are not model properties. They are architecture properties, which is why they cannot be patched by a better model or a longer validation report.

Agentic AI Risk Management: How to Govern the Five Classes

Agentic AI risk management is not a new function bolted onto model risk. It is the same discipline as governing the decision, applied as risk management:

Inventory where agents already act, and rank those actions by consequence. You cannot manage a risk surface you have not mapped, and most organisations underestimate how many agents already act unsupervised.
Bound authority explicitly. For the highest-consequence actions, define what the agent may do alone and what escalates, as an authority envelope enforced in the runtime rather than in policy prose. This closes authority risk.
Monitor continuously, not periodically. Watch behaviour against intent in real time, with escalation and degradation paths. This closes cascade risk.
Govern the inputs and instrument the trail. Control which data feeds each decision and write a decision record for each action. This closes context and opacity risk.
Assign owners and measure. Give every agentic action a named human owner, and track two numbers as autonomy scales: the cost per decision, including the oversight it consumed, and the delegation ratio, the share of consequential decisions machines now make alone. This closes accountability risk. These are also the two figures a board needs to judge whether autonomy is being extended safely.
Prove it on one workflow, then expand, the same one-decision-at-a-time path that moves an organisation from assisted to fully autonomous decisions safely.

This is the discipline NATARAJA calls Decision Accounting, operationalised through Horus and the NTRJ Episteme Executive Decision Platform, and it rests on the 5 Laws of Sovereign Decision Making: the same architecture that makes autonomy governable is what makes agentic AI risk manageable.

How to Define and Tier Agent Risk

Step one above says inventory and rank by consequence. That instruction fails in practice unless the organisation agrees what an agent risk definition contains, because otherwise every team invents its own and the register cannot be compared across them.

A workable agent risk definition has six fields, and they are deliberately about consequence rather than about technology:

Field	The question it answers	Why it drives risk
Authority scope	What may this agent decide or commit on its own?	Defines the blast radius of a single wrong conclusion
Reversibility	Can the action be undone, and by whom, within what window?	An irreversible action removes the correction step every other control depends on
Blast radius	How many customers, records, or currency units can one run touch?	Separates a nuisance from an incident
Data sensitivity	What classes of data feed the decision and appear in its output?	Governs both the harm and the regulatory regime that applies
Human gate	Is a named human required, and can a machine or an operator bypass that requirement?	The difference between an approval step and an authority
Autonomy level	Does it advise, act with confirmation, or act alone?	Determines whether failure is caught by a person before it lands

Tiering follows from the fields rather than from opinion. A workable four-tier scheme: T0 advisory only, output always read by a person before action. T1 acts alone but reversibly, within narrow limits, on non-sensitive data. T2 acts alone with material consequence, or on sensitive data, or where reversal is costly. T3 acts on decisions that are irreversible, externally visible, or fall inside a regulated high-risk category.

The tiers rest on two axes that a board can use directly. Our Executive Guarantees Brief on boundary enforcement classifies every boundary by released authority, from advisory (the system recommends) through assisted and material execution to strategic execution (the system can affect enterprise viability), and by released exposure, from a failure that stays local to one that threatens enterprise stability. A boundary is critical when both are high. Most tiering schemes omit the rule that follows: spending on containment and the frequency of testing must rise with released authority and released exposure, and a critical boundary needs a named owner and regular pressure testing rather than an annual review.

Customising this for your organisation is mostly a matter of setting the thresholds, not changing the fields. A bank might define T3 by monetary limit and by whether the decision affects a customer's access to credit. A hospital would define it by clinical consequence. What should not vary is the rule that tier is assigned by consequence rather than by how sophisticated the agent is: the riskiest agent in most enterprises is a simple one wired into a consequential system.

How to Assess Agentic AI Risk: A Four-Part Assessment Framework

An agentic AI risk assessment is not model evaluation with a wider test set. Accuracy tells you how often the output is right. It does not tell you what happens the time it is wrong, which is the question risk management exists to answer.

Four assessments, in increasing order of what they cost you to run:

Authority conformance. Over a sample of real runs, what share of actions stayed inside the agent's granted limits? Anything below 100% is not a tuning problem, it is an ungoverned action that already happened.
Reconstruction test. Take one decision the agent made last month and rebuild it from its own record: inputs, reasoning, alternatives, the authority it acted under. The time this takes is your true audit readiness, and it is usually much worse than teams expect. When Hugging Face reconstructed what OpenAI's agents had done inside its systems in July 2026, it took two weeks, some 17,600 recovered actions, and an open-weight model, because the frontier models it tried refused to analyse an exploit. That is what audit readiness looks like for a capable security team without a decision record. If the runtime writes the record as the agent acts, the same reconstruction is a database query.
Consequence rehearsal. For the top-tier agents, walk one plausible wrong decision all the way through to customer impact, correction cost, and disclosure obligation. Most organisations discover their reversal path is theoretical. PocketOS discovered it in April 2026, when a coding agent deleted its production database and the backups in nine seconds. The backups were in the same volume.
Adversarial and drift probing. Test whether the agent's objective can be nudged by crafted inputs, whether its tools can be turned to unintended uses, and whether its behaviour has moved since deployment. Set the level of this test by what an attack now costs. In September 2026 Gambit Security documented one operator running three open-source agent frameworks against online retailers: 105 attack projects in five days, at least 27 companies breached, more than 600,000 card records taken, a mean of $25.46 per target, and under 2,000 human prompts across the whole campaign. Attackers now use agents too, at machine speed and machine cost. The test should assume that.

Run the first two continuously and the second two on a schedule proportional to tier. An evaluation regime that produces a number nobody acts on is theatre; each of these four produces a finding with an owner.

Agent Risk and Model Risk Regimes: PRA, FCA, FINRA, MAS and the EU AI Act

Banks already run model risk management, and the natural instinct is to file agents under it. That is half right, and the half that is wrong is expensive.

The UK PRA's model risk management principles for banks (SS1/23, in force since May 2024) expect firms to identify and inventory models, validate them proportionately to risk, and maintain fallback mechanisms, escalation paths, and monitoring for models in customer-facing use. FCA-only firms are not directly in scope, but FCA supervisory expectations on model governance run along the same lines, and the EU AI Act's Article 9 risk management requirement points the same way for high-risk systems. Singapore's MAS FEAT principles add fairness, ethics, accountability and transparency expectations for financial institutions using AI in decisions about customers.

In 2026 supervisors began to address agents specifically. FINRA's 2026 regulatory oversight report carries its first section on AI agents, names the risk that an agent "may take actions that exceed the user's actual or intended scope or authority", and asks firms to monitor access and data handling, decide where human oversight is necessary, track agent actions and decisions, and establish guardrails that constrain agent behaviour. The FCA's chief executive called agentic systems "a profound step change" in June and ruled that "accountability for regulated activities and outcomes must remain clear". Germany's KI-MIG, in force since July, lets BaFin fine banks and insurers up to 35 million euros or 7% of global turnover for prohibited AI practices, with high-risk oversight following the EU timetable from December 2027. And Singapore, whose MAS FEAT principles govern the model, now has a second instrument that governs the agent: IMDA's Model AI Governance Framework for Agentic AI, launched in January and updated in May, which asks organisations to bound risk upfront by "placing limits on agents' powers", to make humans accountable by "defining significant checkpoints at which human approval is required", to control "access to whitelisted services", and, since May, to treat access controls, guardrails, human approvals, logging and monitoring as core components of an agent and to watch human override rates and response times so that oversight does not decay into automation bias. The framework is voluntary, but the organisation remains legally accountable for what its agents do. This article takes the same position.

The model risk regimes govern the model: is it sound, is it validated, is it monitored, is it explainable. An agent introduces a second question that model risk was not written to answer: was the action it took authorised, and by whom. A perfectly validated model inside an agent that exceeded its authority produces a clean model risk file and an incident. The practical response is not a parallel regime but an extension of the existing one: carry your model inventory forward into an agent inventory, add authority scope and human gate to the fields you record, and treat authority conformance as a monitored control alongside performance and drift.

For the operational mechanics of finding those agents and binding each to an identity and an owner, see AI agent inventory and non-human identity.

Where the Stakes Are Highest

Agentic AI risk is not evenly distributed. It concentrates wherever an autonomous action is consequential and irreversible: credit and payment decisions in banking, hiring and essential-services decisions, critical infrastructure. These are precisely the uses the EU AI Act classifies as high-risk, and that Korea's Framework Act on AI, in force since January 2026, places under its own high-impact regime, which is why an enterprise that manages agentic AI risk well is already most of the way to conformity when the high-risk deadline arrives in December 2027. Risk management and regulatory readiness are, at this layer, the same work. Boards should treat them as one agenda item, a point developed in Agentic AI Governance for Enterprise Boards.

Frequently Asked Questions

What Is Agentic AI Risk?

Agentic AI risk is the risk that an autonomous AI agent takes a consequential action outside its authority, on the wrong data, through untraceable reasoning, or without a clear owner, and that the organisation cannot see, stop, or answer for it in time. It is about the consequences of autonomous action, not the accuracy of a prediction.

How Is Agentic AI Risk Different From Model Risk?

Model risk asks whether a prediction is accurate, fair, and explainable, with a human reviewing each output. Agentic AI risk asks whether an autonomous action was permitted, correct, and accountable, with no human in the individual action. Model risk lives in the model; agentic AI risk lives in the gap between the model and the consequence.

What Are the Main Risks of Agentic AI?

Five classes: authority risk (acting outside intended scope), cascade risk (errors compounding across chained actions), context and data risk (acting on ungoverned data or reconstructed context), opacity risk (untraceable reasoning behind a consequential action), and accountability risk (no named owner when something goes wrong).

How Do You Manage Agentic AI Risk?

Not with a new function bolted onto model risk, but by governing the decision itself: inventory where agents act, bound their authority explicitly, monitor behaviour continuously, govern the data and record the reasoning, and assign a named owner to every consequential action. These are the controls of an agentic AI governance framework applied as risk management.

What Is Agentic AI Risk Management?

Agentic AI risk management is the discipline of identifying, bounding, and monitoring the risk that autonomous agents create when they act, rather than the risk that a model creates when it predicts. It extends traditional model risk management with five controls the model layer cannot provide: explicit authority limits, continuous alignment monitoring, decision-level data governance, traceable reasoning, and named accountability for every consequential action. In practice it is an agentic AI governance framework run as a risk function.

What Is an Agent Risk Definition?

An agent risk definition is the record that fixes how risky a given agent is and why, so that the judgement can be compared across teams and revisited when something changes. Six fields carry it: authority scope (what the agent may decide alone), reversibility, blast radius, data sensitivity, whether a named human gate exists and whether it can be bypassed, and autonomy level. Tier follows from those fields rather than from the agent's technical sophistication, which is why a simple automation wired into a payment system usually outranks an elaborate assistant that only drafts text.

How Do I Customize Agent Risk Definitions?

Change the thresholds, not the fields. The six fields above travel across organisations because they describe consequence; what varies is where your tiers cut. A bank sets the top tier by monetary limit and by whether a decision affects a customer's access to credit, a hospital by clinical consequence, a retailer by customer-visible commitment. Two rules make customisation safe: assign tier by consequence rather than by how advanced the agent is, and require that any change to a threshold re-tiers the affected agents rather than grandfathering them, because a definition that only applies to new agents leaves the existing population governed by the old assumption.

How Do You Evaluate or Assess Agentic AI Risk?

Evaluate an agent by its actions, not only its accuracy. For each autonomous or near-autonomous decision, assess five things: whether its authority is explicit and machine-readable (authority risk), whether errors can compound across chained actions (cascade risk), whether it acts on governed data (context and data risk), whether its reasoning is reconstructible (opacity risk), and whether a named human owns the outcome (accountability risk). An agent that scores well on model accuracy but cannot answer these five is a high-risk deployment regardless of its benchmark performance.

How Does Agentic AI Fit Into Enterprise Risk Management?

Agentic AI belongs on the enterprise risk register as an operational and conduct risk, not only a technology risk. Because an agent acts, its failures land as financial loss, regulatory breach, or reputational damage in the same categories the board already governs. The practical move is to treat each high-consequence agent as a named exposure with an accountable owner, an authority limit, and an escalation path, so that agentic risk is reported through the existing enterprise risk framework rather than sitting invisibly inside the technology function.

Conclusion

The organisations most exposed to agentic AI are not the ones with the weakest models. They are the ones with strong models and no answer to a simple question: when this agent acts, on whose authority, on what data, through what reasoning, and who owns the outcome? Traditional AI risk management cannot answer it, because it was built to inspect predictions, and agentic AI does not stop at predictions. It acts. Governing that action is the whole of agentic AI risk, and it is architecture, not paperwork. The company that has that architecture in place is what we call the Autonomous Organisation, and the difference between it and a merely agentic enterprise is the difference between exposure and accountability.

To see where your own autonomous systems carry the most agentic AI risk, and which of your AI investments are actually improving decisions rather than just adding exposure, start with an AI Value Realisation Review or request a governed pilot. We will scope a starting point together, measured on decision velocity, auditability, and leadership confidence.