Arun Saraswat

The book

Trust-Autonomy Gap self-assessment

Twelve questions place you on the book's Agentic Security Maturity Model, and two more check whether the agent you run with the most autonomy operates above the level anyone approved (that check covers one agent only). Answer for the agents in your organization that can act.

Count an agent that can read sensitive data, write to a system of record, communicate outside the organization, execute code, spend money, or act under a delegated identity.

The questions

Agents inventoriedDo you have a current inventory of the AI agents running in your organization?
Owners identifiedDoes every agent that can act have a named business owner?
Basic loggingDo the agents that can act keep basic logs of what they did?
Scope boundariesIs each agent's scope written down: the tools, data and actions it may use, and what is not allowed?
ASRB establishedIs there a standing AI Safety Review Board, or an equivalent, that can approve, constrain, suspend or retire an agent deployment?
Policies documentedAre the rules for agents written down as policy: acceptable use, permission and scope, Authority Cards, audit logging and incident response?
Behavior monitoringIs agent behavior monitored against a baseline, with unusual actions flagged for a person to review?
IR testedHave you tested your incident response for the agents that can act, for example by running a containment drill?
Metrics reportedAre governance metrics for agents reported to leadership or the board?
Governance in SDLCIs governance of agents built into your software development lifecycle?
Continuous improvementWhen an incident or a scope change happens, does the lesson improve your next design review?
Automated responseCan a policy threshold trigger a defined response automatically, such as suspending an agent's tool routes or revoking its credentials?
Think of the agent you run with the most autonomy. At which level of the Spectrum of Autonomy does it actually operate today?
For that same agent, which level did your organization formally approve and record?

Your individual answers are not sent anywhere, and we never receive your name or email through analytics. Only if you accept analytics cookies: Google Analytics records page views plus your result level and autonomy check, and Microsoft Clarity records how you use this page, including session replay with page text masked. Both set cookies. If you decline, neither runs. Privacy