With Great Capabilities Come Great Responsibilities: Introducing the Agentic Risk & Capability Framework for Governing Agentic AI Systems

🕒 Published (v1): 2025-12-22 03:51 UTC · Source: Arxiv · Venue: AAAI 2026 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

The ARC (Agentic Risk & Capability) Framework is a technical governance framework for organizations to systematically identify, assess, and mitigate safety and security risks in agentic AI systems. It introduces a capability-centric lens—analyzing what actions an agent can autonomously execute—layered atop component and design analysis, and maps each risk source to specific materialized risks and tiered technical controls.

Problem

Existing regulatory frameworks (EU AI Act, NIST RMF) provide only high-level principles, while cybersecurity-oriented approaches (MAESTRO, OWASP) are too complex for non-security developers and rely heavily on human oversight. Neither enables scalable, contextualized, per-system risk assessment across the rapidly diversifying space of agentic deployments. Ad-hoc per-system risk assessments are unsustainable as organizations scale agent adoption.

Method

ARC structures governance around three elements: (1) Components (LLM, tools, instructions, memory), (2) Design (agentic architecture, roles/access controls, monitoring/traceability), and (3) Capabilities—the novel axis, covering 12 granular capabilities grouped into cognitive (planning & goal management, agent delegation, tool use), interaction (natural language communication, multimodal, official communication, business transactions, internet access, computer use, programmatic interfaces), and operational (code execution, file & data management, system management).

Risks are enumerated via a Risk Register: each entry is a triple (element → failure mode [agent failure / external manipulation / tool malfunction] → hazard category [data, application, infrastructure, IAM, illegal activities, discriminatory content, inappropriate content, safety, misrepresentation]). Organizations contextualize risks on 5-point impact and likelihood scales, apply a relevance threshold based on risk appetite, and then assign tiered controls—Cardinal (Level 0, mandatory), Standard (Level 1, adapt meaningfully), Best Practice (Level 2, high-risk systems only). Two worked examples (a deep-research agent: 38 raw risks → 10 relevant; a vibe-coding agent: 48 raw risks → 25 relevant) demonstrate the reduction workflow.

Key Contributions

• Novel capability-centric perspective for analyzing agentic systems, treating capabilities (actions the agent can execute) as distinct from affordances (component/design properties).
• Taxonomy of 12 granular capabilities across three categories (cognitive, interaction, operational) applicable across diverse agentic architectures.
• Structured Risk Register schema linking element × failure mode × hazard, with each entry backed by real-world evidence.
• Three-tier control system (Cardinal / Standard / Best Practice) enabling proportional compliance burden.
• Worked examples with full risk counts and relevance filtering, including a draft Risk Register (Appendix B) and control catalog (Appendix C) as organizational starting points.

Results

No empirical benchmark evaluations are reported. The paper presents two qualitative worked examples: - Researcher agent (deep-research): 38 applicable risks → 10 relevant → 17 associated controls after relevance filtering. - Vibe Coder agent (code generation + deployment): 48 applicable risks → 25 relevant risks, reflecting more capabilities and a lower organizational relevance threshold.

Limitations

• No empirical validation of the Risk Register or controls; the framework is entirely descriptive/prescriptive.
• Risk Register requires continual manual updating as the agentic AI landscape evolves; no automated tooling for this is provided.
• Residual risk identification is acknowledged as intrinsically difficult and system-specific; the framework does not offer a method to quantify it.
• Combinatorial risks arising from interactions between multiple capabilities are noted as a gap but not systematically addressed.
• Relevance thresholds and impact/likelihood scores are organizational judgment calls with no calibration guidance.
• Comparison to other frameworks is space-limited and only qualitative.

Relevance to Agentic AI / LLM Agents

This framework directly addresses the governance gap for production agentic deployments, where tool-use, multi-agent orchestration, and autonomous action create risk surfaces that static LLM safety work does not cover. The capability taxonomy (especially the distinction between cognitive, interaction, and operational capabilities) provides a vocabulary for practitioners building or auditing agent systems—aligning with concurrent work on privilege control (Progent, AgentSpec) and prompt injection defenses. The tiered control model and Risk Register template are immediately actionable for teams productionizing agents with internet access, code execution, or business transaction capabilities. For researchers, the framework surfaces the lack of systematic, organization-level empirical evaluations as an open problem.