Agentic AI risk management standards profile
B · Useful, limited UC Berkeley CLTC standards profile extending the NIST AI RMF to agentic systems; credible, detailed practice guidance from an academic security group, but a framework with no empirical testing.
Summary based on the full text·Original: about 100 minutes to read
In short
A 67-page February 2026 profile by Nada Madkour, Jessica Newman, Deepika Raman, Krystal Jackson, Evan R. Murphy and Charlotte Yuan at UC Berkeley's Center for Long-Term Cybersecurity. It sets practices and controls for developers and deployers of AI agents, organised around the NIST AI RMF functions Govern, Map, Measure and Manage. It extends Berkeley's earlier General-Purpose AI profile (Version 1.2) to risks that arise when AI systems act on a user's behalf.
Key numbers
- Version 1.0first release of the Agentic AI Profile, February 2026
- L0lowest of the profile's autonomy levels: the user has direct control with no agent support
- L5highest autonomy level: the user only observes while the agent operates fully on its own
As reported by the source.
English·PDF·opens cltc.berkeley.edu
What it reports
- Risk areas: discrimination and toxicity, privacy and security (memory leakage, cascading compromise), cascading misinformation between agents, misuse (automated cyber or biological attack stages, swarm influence campaigns), reduced human oversight and over-reliance, loss of control (oversight subversion, actions outrunning monitoring), socioeconomic harms, and failures such as self-replication, reward hacking, collusion and deceptive behaviour.
- Governance should scale with the degree of agency rather than treat autonomy as yes or no. It proposes six autonomy levels, L0 to L5, adapted from Kasirzadeh and Gabriel (2025), plus a definition of each agent's authority.
- Key levers: clear roles, intervention points, escalation paths and shutdown mechanisms; system-level risk assessment covering tools and multi-agent interaction; continuous post-deployment monitoring; defence in depth.
- It recommends treating capable agents as untrusted, because models may behave differently in evaluation and deployment.
- Each selected NIST subcategory (for example Map 1.1, Manage 1.3, Manage 2.4 on deactivation) gets agent-specific guidance and resources.
How they got it
Synthesis of technical, policy and security research on agents and AI control, mapped onto the NIST AI RMF. Subcategories were chosen if they were high priority in the GPAI profile or needed extra treatment for agents.
Limits
- No case studies or tests of whether the controls work in practice.
- The authors note there is no agreed definition of "AI agent" or of autonomy levels, so terms may not line up with other frameworks.
- Weighted towards frontier and catastrophic risks. Ordinary enterprise deployers will need to filter heavily.
Why it matters for companies
Companies rolling out agents can use the L0 to L5 scale to classify each use case and set controls by level instead of applying one policy to every agent. The practical requirements are concrete: a named owner, documented authority limits, logging, a tested way to switch the agent off, and monitoring after launch. Because it maps to NIST, it fits existing AI governance and audit structures rather than adding a parallel one.
Summary based on the full text. Read the original for the full argument and data.Open PDF on cltc.berkeley.edu
- Tags
- AI agents