Agentic AI Risk Control Matrix
By Aslınur Alkan, Benjamin Hong, Beste Özyurt Ersöz, Bhoomika Hanbal Puttaswamy, Frances Chinaza Agba, Kevin Braza, Peri Yakar, Shalom Chimkwesiri Okeke
October 2026
A practical governance framework for assessing what an AI agent can do, what impact its actions may create, and what controls are required before deployment.
Authors
Research Fellow
Research Fellow
Research Fellow
Research Fellow
Research Fellow
Research Fellow
Research Fellow
Research Fellow
Advisor & Editor
Authors
Aslınur Alkan
Research Fellow
Benjamin Hong, M.S.W. Cand.
Research Fellow
Beste Özyurt Ersöz, Ph.D.
Research Fellow
Bhoomika Hanbal Puttaswamy, M.Sc.
Research Fellow
Frances Chinaza Agba, M.Sc.
Research Fellow
Kevin Braza, M.Sc.
Research Fellow
Peri Yakar, M.Sc.
Research Fellow
Shalom Chimkwesiri Okeke, LL.M.
Research Fellow
Advisors & Mentors
Advisor & Editor
Originally Published
OCTOBER 2026
Research Overview
What can the agent do—and what happens when it is wrong?
Agentic AI changes the governance question from what a model might say to what a system is permitted to do. Agents can access data, call tools, trigger workflows and act across external systems without case-by-case approval.
The Agentic AI Risk Control Matrix turns that governance challenge into a repeatable assessment method. It evaluates autonomy and impact as separate dimensions, then connects their intersection to a proportionate control posture, oversight expectation and evidence requirement. The result is a practical way to decide whether a specific use case may proceed, needs tighter restrictions or must be redesigned before deployment.
Research at a Glance
A two-dimensional model for proportionate agent governance
Autonomy Levels
L0 to L5 classify what a deployed agent is actually permitted to do—from responding only to high-impact autonomous execution.
Impact Classes
I0 to I3 assess the consequences of failure independently—from negligible and reversible to critical and irreversible.
Matrix Intersections
Every autonomy–impact combination maps to a control posture and the evidence expected at that level.
Cross-Sector Scenarios
The scenario library spans every autonomy level; five use cases are fully annotated to show the framework in practice.
Classification Framework
Classify autonomy first. Assess impact separately.
Seven yes-or-no questions assign the use case to one of six autonomy levels. An eighth question assesses the possible impact independently and does not change the autonomy level. This separation prevents a low-autonomy but high-impact system—and a highly autonomous but tightly bounded system—from being treated as equivalent.
Key Findings
What the framework revealed
The findings focus on deployment conditions—not on broad labels applied to the underlying model.
Two dimensions, two decisions
An advice-only system may influence an irreversible outcome, while bounded autonomy can remain negligible when permissions are technically constrained.
Coverage stays separate from exposure
Strong control coverage does not reduce the inherent tier. A well-controlled system may still require redesign when the underlying exposure remains too high.
A workflow-grounded risk taxonomy
Three risk families and nine domains were derived from the agent’s operating workflow and then indexed to the OWASP Top 10 for Agentic Applications.
Internal validation improved the tool
Seven of eight test scenarios produced the expected result. The remaining case exposed a calibration issue and led to a revision of the assessment instrument.
The fleet scenario stays unacceptable
A worked high-autonomy, critical-impact case reached 13 of 15 control points—yet remained unacceptable as configured because controls cannot erase tier-four exposure.
Redesign before deployment
At the highest inherent tier, deployment should not proceed as assessed. The operating envelope, autonomy or impact must change before reassessment.
How the Framework Works
From a use case to an evidence-backed control posture
The four-step protocol keeps the assessment focused on the actual deployment and makes the decision easier to reproduce and justify.
Define the Use Case
Describe the agent’s intended action, objective, operating boundaries and the systems or data it may touch.
Classify Autonomy
Use the decision tree to assign L0–L5 based on what this deployment is permitted to do—not on the technology’s theoretical capability.
Assess Impact
Assign I0–I3 independently by asking what happens when the system is wrong, including reversibility and blast radius.
Apply Controls and Evidence
Use the matrix intersection before deployment, then record the required controls, oversight and evidence for that posture.
Interactive Toolkit
Move from reading the framework to assessing a real use case.
The interactive toolkit brings the classification tree, control matrix, risk taxonomy, scenario library and working assessment instrument into one accessible reference.
- Assign an L0–L5 autonomy level
- Assess I0–I3 impact independently
- Explore all 24 matrix positions
- Review the required control posture
- Run amplifier and coverage checks
- Identify evidence and readiness needs
Research Notes
Scope, limitations and citation
Use the expandable sections below for responsible interpretation and attribution.
Scope and Limitations
- The framework is a governance aid, not formal assurance, certification or legal advice.
- Version one focuses on single-agent deployments; inter-agent communication and cascading failure remain future work.
- The instrument was calibrated against the research team’s own judgement across eight scenarios and has not yet been independently validated through a live organisational engagement.
- The base grid, amplifier weights, escalation thresholds and coverage bands are project calibration rules rather than values derived from an external standard; no sensitivity analysis was performed.
- The literature base is a purposive sample, not a systematic review. Scenario coverage was designed around autonomy levels rather than complete coverage of all risk domains.
- The ISO/IEC 42001 Annex A crosswalk and parts of the highest-autonomy evidence checklist remain future work.
Suggested Citation and License
Alkan, A., Hong, B., Özyurt Ersöz, B., Hanbal Puttaswamy, B., Agba, F. C., Braza, K., Yakar, P., & Okeke, S. C. (2026). “Agentic AI Risk Control Matrix.” HUX AI.
Licensed under the Creative Commons Attribution–NonCommercial 4.0 International License (CC BY-NC 4.0).