Agentic Risk Analyst

What could go wrong with this AI use case, and what should we do about it?

Chirag Dani · ARA v3.2.1
LLM: huggingface · meta-llama/Llama-3.3-70B-Instruct · Secure-RAG: connected

Library / ARA-261031-079D53 / governance

Worked example: Autonomous incident-response agent (SOC)

Versions of this assessment, reviewer sign-off, suggested framework mapping, and every linked deliverable.

Sign-off

Sign off version 1 (the latest run). 10 of 10 items are not yet reviewed; the sign-off will record this.

Versions (1)

VersionSaved (UTC)ModelSHA-256
12026-10-31 06:37:15Worked example: prepared in advance, not generated liveb6087d393ed3ef29

Client

Item-by-item review

Confirm each AI-drafted risk, threat, regulatory finding and control. 0 of 10 reviewed (0 changed, 0 rejected). "Accepted with changes" needs a note describing the change. The counts are sealed into the sign-off.

TypeIDItemReviewNoteLast reviewed
riskR-01Agent disables critical accounts or servers (Critical)
riskR-02Attacker triggers the agent against the organisation (Critical)
riskR-03No audit trail of agent reasoning (Medium)
threatT-01Alert injection steering agent actions (Critical)
threatT-02Compromise of agent credentials (High)
regulationREG-01APRA CPS 234 Information Security: potentially_applicable
regulationREG-02APRA CPS 230 Operational Risk Management: potentially_applicable
controlC-01Operating envelope with tiered autonomy
controlC-02Protected asset list and kill switch
controlC-03Action and reasoning audit log

Deliverables

Board pack (Word)Risk register (Excel) Printable report
Failure simulationsnone
Operating envelopesnone
ADM inventory entriesnone (add)
Vendor reviewsnone (start)

Framework mapping (suggested)

Suggested by keyword rules at heading level; verify each mapping against the licensed standard before using it in a statement of applicability or audit.

ControlISO/IEC 42001 Annex ANIST AI RMFISO/IEC 27001:2022OWASP LLM 2025
C-01 Operating envelope with tiered autonomyA.5 Assessing impacts of AI systems; A.9 Use of AI systems--LLM06 Excessive Agency
C-02 Protected asset list and kill switchA.6 AI system life cycleMANAGE--
C-03 Action and reasoning audit log--8 Technological-

Headings with no mapped control

ISO/IEC 42001 Annex A: A.2 Policies related to AI; A.3 Internal organization; A.4 Resources for AI systems; A.7 Data for AI systems; A.8 Information for interested parties of AI systems; A.10 Third-party and customer relationships

NIST AI RMF: GOVERN; MAP; MEASURE

An uncovered heading is a prompt to check whether a control is needed, not proof of a gap.

Decision support only, not legal or regulatory advice. AI-generated ratings and citations must be reviewed by a qualified person before they are relied on.