The risk profile: factors, tiers, controls

Two agents run at the same autonomy level. One summarises public documents. The other reads customer records and takes text from strangers. They do not carry the same risk. An autonomy level says who holds the decision. It does not say what can go wrong, and neither does a role name. So every agent gets a risk profile before it goes live. Score it on nine factors, each Low, Medium or High. The worst factor sets one of three tiers: Tier 1 (basic), Tier 2 (enhanced) or Tier 3 (strict). The tier sets the controls, who signs, and how often the agent is reviewed.

The tier is stored on the agent's registryAgent registry. The official list of agents: what each is for, who owns it, what it may touch, and which version is live.Read the page record. It is scored again on every change, as part of the agent lifecycle. Score what the agent's own credentials can do and what it can damage. Those are its permissions and its impact, two of the four questions for any agent.

The nine factors

The first factor uses the six autonomy levels from the autonomy contract. At manual (A0), a person does the work. At assisted (A1), the agent suggests and a person acts. At delegated tasks (A2), a person reviews every output. At supervised autonomy (A3), a person approves anything that cannot be undone. At managed autonomy (A4), people work a queue of exceptions. At governed lights-out (A5), people set policy and audit the results.

Three more terms appear in the table. A deterministic zone is one of four areas where a fixed system or a named person decides, not the model. The four are access, money, safety actuation and formal records, set out on the deterministic zones page. The zone register is the signed list of every zone action and who decides it. The Rule of Two says one session should hold at most two of three things. They are untrusted input, sensitive data, and the power to act or send outside.

How to read the factors:

• Credentials means what the credential allows, not what the tool description promises.
• Undone scores the effect, not the action. Data that has leaked cannot be taken back. The Cloud Security Alliance (CSA) draws the same line in its autonomy levels v2.0 (18 March 2026).
• Data class uses the five classes in the sovereignty matrix: public, internal, confidential or personal, regulated, control-system. Outputs inherit the highest input class. Microsoft documents that Agent 365 output does not inherit the source's sensitivity label [vendor].
• Untrusted input is any text the organisation did not write or check, such as emails, tickets and customer chat. The Rule of Two comes from Meta (31 October 2025) [vendor]. All three parts in one session score High.
• Decisions about people follow the law, not the action. An HR screening agent can be read-only and still score High. The rule for decisions about people applies. A named person makes any significant decision about a person.
• Oversight is a modifier because it is weak when measured. The figures are under Evidence and limits.

The tier rules

1. Three tiers. Any High gives Tier 3. Any Medium gives at least Tier 2. All Low gives Tier 1.
2. Always High. These set Tier 3 whatever else is true:
   • an action inside a deterministic zone (access, money, safety actuation, formal records);
   • destroying anything in production;
   • code or SQL run against production;
   • regulated or control-system data;
   • a significant decision about a person.
3. One exception. A fixed zone transaction whose effect can be undone sits at Tier 2. It must be named in the signed zone register. A fixed service must run it, not the model. IMDA's Dayos case puts password resets in its lowest tier. The rule here is stricter.
4. The Rule of Two caps autonomy. If one session holds all three parts, autonomy is capped at delegated tasks (A2). A person reviews every output.
5. A multi-agent system takes its highest member's tier. This follows the TrustX ARC framework.
6. When unsure, go up. This follows the fail-safe rule in GAIE.
7. Demote at once. Promote on evidence. An anomaly or a change of scope demotes the agent at once. Promotion needs controls in place and evaluation results. A count of clean runs is not enough. A short run of passes is a small sample and can hide a real failure rate. So GAIE's rule of twenty clean deployments is not used here.

The worst-factor rule comes from TrustX ARC (preprint, 10 July 2026). The go-up rule comes from GAIE (preprint, 21 June 2026).

Intake can stay simple. Ask one question first: is every factor Low? If yes, the agent takes the Tier 1 path. If not, a review assigns Tier 2 or Tier 3. Telstra works this way. It dropped its medium risk tier at intake (UTS Human Technology Institute case study, May 2026).

Controls, sign-off and review by tier

Each tier adds to the one below. Tier 1 passes on pipeline evidence alone. A few terms in the table need a word first. The agent's own identity (ID2) means its own account, least privilege, short-lived credentials and a named sponsor. It is set out on the delegation chain. A policy decision pointPolicy decision point. The component that says yes or no to an action by checking rules against who is asking. The agent asks, the decision point decides, and the agent cannot skip it.Read the page is a service outside the model that allows or blocks each action. Plan-then-apply means the agent proposes a plan and a fixed system applies it after approval.

Tier 1 needs no change board. DORA research links heavy change approval with worse delivery.

The autonomy crosswalk

Other published autonomy scales line up with the six levels here. Each level also sets the lowest tier an agent at that level can have.

The CSA column is from v2.0 (18 March 2026). It is reported as AI-assisted and not formally reviewed. Gartner's four levels date from 26 May 2026, and AWS's four scopes from 21 November 2025. The mapping reads each source's own definitions.

Gartner mixes two things in one scale: whether the agent can write, and whether a person approves. So no exact map exists. One mapping is open. CSA's level 0 is named None (human execution), which by name is A0. Its definition is "AI informs, humans act", which is A1. The table maps by definition.

Code and SQL on live systems

Code and SQL on live systems do raise risk. IMDA, CSA, ARC and the permission models in coding tools all rank acting above reading. Three findings shape how factor 2 is scored.

Reads can leak. In July 2025 a coding assistant read a support ticket with hidden instructions. It then read a secrets table and posted the result back into the ticket. Its database credential skipped the row-level security on that table. Reads can also be silently wrong.

Labels fail, so score the credential. An injected command ended the read-only mode of a reference database tool (Datadog Security Labs, 21 August 2025). What holds is a database role that can only read, used under the person's own identity.

The deletions came from standing production rights. Four public incidents fit one pattern. Each agent held its operator's production rights and had shell or infrastructure access. None had a stop outside the model. Reviewed code shipped through a pipeline is a different path. The cases are under the destruction rule and in the research block below.

Three worked examples

Three utility agents, scored on all nine factors. The four questions page describes the same three agents.

The chat agent is Tier 2. Several factors are Medium and none is High. Its replies go only to the customer whose account it reads. So it does not hold all three parts of the Rule of Two. It stays below High while account changes go to a person.

The billing-exception agent is Tier 3. Changing a bill is a money zone action. Hardship cases also bring in the rule for decisions about people. It drops to Tier 2 only under the one exception. The release must be a fixed rule in the signed zone register, and its effect must be undoable. A fixed service must run it. Hardship cases stay at Tier 3.

The vegetation inspection agent is Tier 1. Every factor is Low. Writing work orders into the asset system would make it Tier 2. The vegetation inspection use case creates inspection requests, so that version sits at Tier 2. The scoring assumes the existing patrol programme still runs. If the agent's misses would go unchecked, score it again.

Where the tier travels

The tier sits on the registry record, beside the owner, sponsor and autonomy level. It picks who signs, what evidence they need, and how often the agent is reviewed. Any change to the model, prompt, tools, permissions, data sources, memory policy, autonomy level or sponsor triggers a new score. The agent lifecycle lists these change triggers. Enforcement outside the model covers the policy decision point, the egress proxy and the kill switch.

Evidence and limits

No study links any tier or factor to incident rates. The Agent Incident Registry (10 September 2026) holds 487 records. Its authors say the data supports case lookup, not failure rates. No published tiering model has been tested against outcomes. ARC and GAIE are preprints with illustrative examples.

Most published models that score several factors end in three tiers. Schemes with four levels rank autonomy instead, and the six autonomy levels already cover that. Both kinds are listed in the research block.

Regulators ask for proportion but name no agent tiers. APRA (30 April 2026) asks for monitoring in proportion to how critical the use is. MAS (7 October 2026) asks firms to rate the risk materiality of each AI use. The Five Eyes guidance (1 May 2026) asks for autonomy in steps and human control points. The tiers here are a synthesis of published models, not a regulatory scale.

One question is open. Microsoft's Cloud Adoption Framework sets one baseline for every agent (1 October 2026) [vendor]. Tier 1 is close to that baseline. Gartner says uniform governance fails. Tiers 2 and 3 answer that warning. Neither side has outcome data.

Oversight is weak when measured. Users approved 93 percent of Claude Code permission prompts (Anthropic, 25 March 2026) [vendor]. In a vendor study reported in August 2026, people caught 13.6 percent of dangerous commands. A classifier caught 89 percent [vendor]. Neither figure has been replicated. So a person's approval is not proof that they checked.

The factor cut-offs, the tier boundaries, the Tier 2 exception and the review cadences are expert judgement. Re-check the regulator items before relying on them.

Next step

Design the controls for the riskiest actions on the four deterministic zones. Then set how freely the agent may act with the autonomy contract.

Explore this topic

• Security and identity findings
• Governance, risk and sovereignty findings
• The sovereignty matrix

Models that end in three tiers. CSA's Capabilities-Based Risk Assessment (CBRA) maps to low, medium and high control baselines. TrustX ARC scores twelve factors into three tiers. GAIE routes code tasks into three oversight tiers. IMDA's agentic AI framework v1.5 (20 May 2026) has two cases. Dayos sorts IT tickets into three tiers [vendor]. MSD collapses five levels of agency into three governance pathways. CBRA's own worked example does not add up (54 shown as 48).

Scales with four levels. Gartner has four autonomy levels (26 May 2026). AWS has four scopes (21 November 2025). BCG has four stages (8 July 2026) [vendor]. Each ranks autonomy, not risk.

Clean runs. Nineteen passes in twenty runs fits a true pass rate as low as 78 percent, at one-sided 95 percent confidence. That is why a count of clean runs does not promote an agent here.

Code and SQL incidents. The Supabase case was reported by Simon Willison on 6 July 2025. A 2024 frontier model solved 21.3 percent of enterprise text-to-SQL tasks on Spider 2.0 (arXiv 2411.07763). The read-only bypass was an injected COMMIT against a reference Postgres MCP server (Datadog Security Labs, 21 August 2025). Databricks Genie runs generated queries under a read-only role and the user's identity [vendor]. The four deletion incidents are Replit (July 2025), AWS Kiro (December 2025), Google Antigravity (December 2025) and a Terraform destroy (26 February 2026). The Kiro case reportedly caused about 13 hours of disruption. Amazon calls it user error from misconfigured access.

Failure studies. A study of 547 coding-tool failures (Hasan and Biswas) has no count of total runs, so it gives no rate.

Regulators. The DTA's impact assessment uses an assessing officer and an approving officer. Its pages timed out, so that point rests on search excerpts.

Sources:

• IMDA agentic AI framework v1.5, 20 May 2026: PDF
• TrustX ARC, arXiv 2607.09586, 10 July 2026: arXiv
• GAIE, arXiv 2606.22484, 21 June 2026: arXiv
• CSA CBRA: CSA
• CSA autonomy levels v2.0, 18 March 2026: CSA Labs
• Gartner, 26 May 2026: press release
• AWS scoping matrix, 21 November 2025 [vendor]: blog
• BCG, 8 July 2026 [vendor]: PDF
• UTS HTI, Telstra case study, May 2026: PDF
• Meta, Agents Rule of Two, 31 October 2025 [vendor]: blog
• Microsoft Purview and Agent 365 [vendor]: docs
• Microsoft Cloud Adoption Framework, 1 October 2026 [vendor]: docs
• Simon Willison on Supabase MCP, 6 July 2025: post
• Datadog Security Labs, 21 August 2025: article
• Databricks Genie [vendor]: docs
• Spider 2.0, arXiv 2411.07763: arXiv
• Replit, The Register, 21 July 2025: article
• AWS Kiro, TechTarget, 23 February 2026: article
• Google Antigravity, TechRadar: article
• Terraform destroy, owner's account: post
• Agent Incident Registry, arXiv 2609.11030, 10 September 2026: arXiv
• Hasan and Biswas, arXiv 2605.30777: arXiv
• APRA, 30 April 2026: letter
• MAS, 7 October 2026: media release
• DTA impact assessment: page
• Five Eyes, Careful Adoption of Agentic AI Services, 1 May 2026: CISA
• Anthropic, Claude Code auto mode, 25 March 2026 [vendor]: post
• Help Net Security, 10 August 2026 [vendor figures]: article
• DORA, change approval: page