How is agentic AI risk different from model risk?

Model risk asks whether a model's outputs are sound. Agentic AI risk also asks what the agent can do: which tools it can call, which data it can reach, which actions it can take, and who is accountable for it.

What is excessive agency?

Excessive agency is OWASP's term for an AI agent that has more functionality, permissions, or autonomy than its task needs, so a manipulated or mistaken agent can cause harm. Least-privilege access and human approval for high-impact actions reduce it.

Why is a one-time AI-agent approval not enough?

Agents change after review: new tools, broader access, a different model, or a new owner. Re-assessing an agent when those change keeps the approved risk and the actual risk aligned.

Should AI-agent remediation be automated?

Consequential changes to an agent's access or behavior should receive human review before they are made. Guided remediation proposes the fix, and an accountable owner approves it.

How does DefenseEye help with agentic AI risk?

DefyAIRisk is DefenseEye's AI-agent risk product. It is designed to help teams keep one register of AI agents, understand exposure in business terms, and coordinate guided remediation with human review before any change. DefenseEye consulting and assessment services help put the surrounding governance in place.

Insight

What is agentic AI risk management?

Agentic AI risk management is the practice of identifying the AI agents an organization runs, assessing what each one can access and do, keeping that view current as agents change, and addressing the highest risks first through owned, approved remediation, with evidence of each decision. It extends model risk management from what a model says to what an agent can do.

The five stages

Identify: keep one register of AI agents, with each agent's purpose, owner, and reach
Assess: rate each agent's risk in business terms on one consistent scale
Monitor: re-assess an agent when its access, tools, model, or owner changes, not only at approval
Address: fix the highest risks first, with an owner, a plan, and human approval before any change
Prove: keep evidence of decisions, approvals, and completed actions for leadership, audit, and regulators

Signs an AI-agent risk program has gaps

No one can produce a current list of AI agents and their owners
Agents hold broader permissions or tool access than their task requires
Risk is described in technical terms leaders cannot compare or act on
Approvals happen once and are never revisited as agents change
Fixes are made directly in production without review, or not made at all
Decisions are scattered across tickets, chats, and spreadsheets

Questions each decision maker should be able to answer

CISO: which agents can reach sensitive data or critical systems, and is that access still justified?
Chief Risk Officer and compliance: is AI-agent risk rated consistently, owned, and on the risk register?
CIO and CTO: how do we keep shipping agents without an approval bottleneck?
Chief AI Officer and AI governance: can we show one current view of agents, risks, and decisions?
Internal audit: is there evidence of who approved each change, and when?

Frameworks to align with

NIST AI Risk Management Framework (AI RMF 1.0): Govern, Map, Measure, and Manage
NIST AI 600-1, the Generative AI Profile of the AI RMF
OWASP Top 10 for LLM Applications 2025, LLM06: Excessive Agency

Frequently asked questions

How is agentic AI risk different from model risk?: Model risk asks whether a model's outputs are sound. Agentic AI risk also asks what the agent can do: which tools it can call, which data it can reach, which actions it can take, and who is accountable for it.
What is excessive agency?: Excessive agency is OWASP's term for an AI agent that has more functionality, permissions, or autonomy than its task needs, so a manipulated or mistaken agent can cause harm. Least-privilege access and human approval for high-impact actions reduce it.
Why is a one-time AI-agent approval not enough?: Agents change after review: new tools, broader access, a different model, or a new owner. Re-assessing an agent when those change keeps the approved risk and the actual risk aligned.
Should AI-agent remediation be automated?: Consequential changes to an agent's access or behavior should receive human review before they are made. Guided remediation proposes the fix, and an accountable owner approves it.
How does DefenseEye help with agentic AI risk?: DefyAIRisk is DefenseEye's AI-agent risk product. It is designed to help teams keep one register of AI agents, understand exposure in business terms, and coordinate guided remediation with human review before any change. DefenseEye consulting and assessment services help put the surrounding governance in place.