Dimension 1: Assess and bound the risks upfront
Is this legally binding?
Guidance. Voluntary guidance. Best practice, not obligation, until a contract or a regulator cites it.
Organisations should adapt internal structures and processes for new agent risks, understand risks posed by the agent's actions (action-space, reversibility, autonomy), and bound risks at planning stage via agent limits and robust identity and access controls.
From the source
“Organisations should adapt their internal structures and processes to account for new risks from agents.”
Section 2.1, pp.9-12
What this connects to
10 relations. Official relations are the ones the source documents state; anything marked GAGE analysis is our reading, not an agency's.
Contains5
- ObligationDetermine suitable use cases via agent-specific risk factorsGuidance
- ObligationPerform threat modelling and taint tracingGuidance
- ObligationBound risks through agent limitsGuidance
- ObligationImplement agent identification and authorisationGuidance
- ObligationEvaluate and accept residual riskGuidance
Verified against the official source on 2026-08-17. GAGE is not affiliated with or endorsed by any agency named here, and nothing on this page is legal advice. How this is built and checked.