AI Agent Risk Classification Worksheet

This worksheet is for CISOs, AI governance teams, risk managers, and product owners who register AI agents before they reach production. It classifies each agent on three dimensions (data sensitivity, autonomy level, and operational scope) and assigns a control tier, so a FAQ chatbot and a payroll agent are no longer governed by the same policy.

Complete it at intake, whenever an agent gains a new tool or data source, and at each scheduled reclassification. It supports the Map and Manage functions of the NIST AI Risk Management Framework.

How to use this worksheet

1. Fill in the agent profile in Part 1.
2. Score each dimension in Part 2 as 1 (low), 2 (medium), or 3 (high).
3. Assign the tier from the highest score, not the average. One high dimension is enough to raise the tier.
4. Apply the tier's controls from Part 3 and record the decision in Part 4.

Part 1: Agent profile

• □ Agent name, purpose, and business owner (a named person, not a team alias).
• □ Technical owner and deployment date.
• □ Models and providers used, and where they are hosted.
• □ Tools and APIs the agent can call, and what each can do: read, write, delete, send, or pay.
• □ Data sources it can reach, including retrieval indexes and shared drives.
• □ Identity it runs as: a dedicated workload identity or delegated user access.
• □ Who can interact with it: employees, customers, or the public.

Part 2: Risk scoring

Raise the tier by one level (to a maximum of high) if any of these apply:

• □ The agent reads untrusted external content and can take actions, which creates a prompt injection path.
• □ It can move money, change access rights, or delete data.
• □ No human reviews irreversible actions before they execute.

Part 3: Control tiers

• □ Low: logging of prompts and actions, standard credential rotation, owner attestation, and quarterly review.
• □ Medium: least-privilege data scopes, access reviews every 30 days, output filtering for sensitive data, human approval for write actions, and rate limits.
• □ High: security review and threat model before deployment, adversarial testing for prompt injection and excessive agency, continuous monitoring with alerting, a tested kill switch, an incident response plan, and executive reporting of any data exposure.

Part 4: Decision record

• □ Assigned tier and the reasoning behind it.
• □ Accepted residual risks and who approved them.
• □ Next review date: every 30 days for medium and high tiers, quarterly for low.

Common pitfalls

• Averaging scores. It hides the one dimension that makes an agent dangerous.
• Classifying the model instead of the deployment. The same model with different tools and data has a different risk profile.
• Skipping reclassification after new integrations. Agents gain capabilities quietly; tie reclassification to change management.
• Using the worksheet as a gate. Offer pre-approved templates for common low-risk agents so teams have a fast path.

For agent-specific threats such as excessive agency, see the OWASP Top 10 for LLM Applications.