Free assessment template
AI Agent Risk Assessment Template
Copy these headings into your review document or use them as interview prompts. Keep answers factual and attach an evidence source where possible.
Agent profile
Start with enough context to understand why the agent exists and who can answer questions about it.
- Agent name and short business purpose.
- Lifecycle status: pilot, active, paused or retired.
- Business owner, technical maintainer and department.
- Users, customers or processes affected.
- Model, automation platform and hosting context where relevant.
Tools, data and permissions
Create one row per tool. Record the exact capability, not only the integration name.
- Tool and account or workspace used.
- Data categories the agent can read.
- Records it can create, update or delete.
- Messages, files, code or transactions it can send or trigger.
- Credential type, scope and rotation owner.
- Why each permission is needed for the stated purpose.
Autonomy and safeguards
Describe the path from input to action and where a person can intervene.
- Events that start the workflow.
- Decisions made by the model or fixed logic.
- Actions that require approval and who can approve.
- Validation, amount, destination or rate limits.
- Logs retained and who reviews them.
- How to pause the agent and revoke access.
Finding template
Use the same structure for every finding so readers can compare importance and response.
- Risk key and short finding title.
- Observed permission or missing safeguard.
- Credible business impact.
- Current likelihood or exposure context.
- Recommended action and priority.
- Action owner, status and target date.
- Acceptance justification and expiry when applicable.
Practical advice
Avoid scoring based on tool reputation. Score what the agent can do with that tool. Read-only access to selected documents is not equivalent to full write access across a workspace.
Re-run the assessment after material access or autonomy changes. Keep prior assessments when you need to show progress.
FAQ
Questions people ask before a review
Move the template into a repeatable assessment.
Create agent records, preserve score history and connect findings to their actions.