Resources · Guide
A risk taxonomy for AI agent actions
“Should this agent be allowed to do that?” is too vague to answer consistently. Break it into a few questions with numbers attached, and two reviewers, or a reviewer and a policy, start agreeing.
The model below is the one AgentPlane uses. Each factor adds points; the total falls into a band. Bands are starting defaults that teams should tune, not validated safety limits.
Low
0 to 24
Allow when a policy says so
Medium
25 to 49
Allow with verification
High
50 to 74
Hold for approval
Critical
75 to 100
Deny unless break-glass
The eight factors
- 1
Impact
What happens if this goes wrong?
A read has almost no impact. A funds transfer or a security change has the most.
read 5 · write 15 · send 18 · export 20 · delete 28 · transfer 30
- 2
Sensitivity
What kind of data is touched?
Public help articles are fine. Personal, regulated and secret data are not.
public 0 · internal 5 · confidential 15 · restricted 22 · secret 30
- 3
Reversibility
Can it be undone?
A draft can be deleted. A sent email cannot be unsent.
read 0 · write 5 · send and export 10 · delete and transfer 15
- 4
Scope
How many things at once?
One record is a mistake. Ten thousand records is an incident.
up to 15 points, rising with the logarithm of record count
- 5
Destination
Does it leave the company?
Internal tickets stay inside. Customer emails and vendor payments do not.
external adds 10
- 6
Environment
Where does it run?
Mistakes in a sandbox are cheap. In production they are not.
staging 3 · production 8
- 7
Authority
How much value moves?
Larger amounts deserve more scrutiny, independent of everything else.
1 point per $1,000, up to 15
- 8
Context quality
Do we know who asked, and why?
An action with no named requester or objective should never be trusted by default.
missing principal 8 · missing objective 5 · ambiguous target 5
A worked example
A support agent wants to email a customer a refund confirmation. It is a send (18), of confidential data (15), that cannot be undone (10), to someone outside the company (10), in production (8). That is 61: high. The email waits for a person, who sees the exact message before it goes.
The same agent reading a public help article scores 5. It runs on its own, every time, and nobody has to look at it.
Three rules that sit above the score
- Some things are never scored. Reading secrets or deleting production data should be a hard deny, whatever the number says.
- Risk only tightens. A high score can turn an allow into a hold; a low score can never loosen a hold.
- Missing context is its own answer. If nobody is named as asking, escalate. Do not guess.
Try it on your own actions
The live engine on the product page scores any action with this exact model, factor by factor.