> ## Content Index
> Fetch the complete content index at: https://www.aigl.blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# TrustX Agent Risk Classification Framework (ARC): Risk-Tiering Internally Created Agentic AI Systems
- URL: https://www.aigl.blog/trustx-agent-risk-classification-framework-arc-risk-tiering-internally-created-agentic-ai-systems/
- Published: 2026-09-19T09:10:01.000Z
- Updated: 2026-09-19T09:10:01.000Z
- Description: A paper from the Responsible AI Institute presenting the TrustX Agent Risk Classification Framework, a twelve-dimension rubric, GPA + IAT checklist and five-level autonomy scale that tier agentic AI systems into three risk levels with mapped controls, plus a coding assistant extension.
- Author: Jakub Szarmach
- Tags: Framework, Agentic AI, Risk Management, AI Governance, AI Security, Compliance & Audit, #aigl-library

## ⚡ Quick Summary

Published by the Responsible AI Institute, this paper presents the TrustX Agent Risk Classification Framework (ARC), a structured, repeatable instrument for risk-tiering internally created agentic AI systems. Its premise is that general-purpose frameworks — NIST AI RMF, ISO/IEC 42001, OWASP agentic guidance, MITRE ATLAS, SR 11-7 and SR 26-2, and the EU AI Act — do not adequately scope agentic AI, whether because they are voluntary, predate its prevalence, or explicitly exclude generative and agentic systems. Disclosed incidents, including the GTG-1002 campaign that manipulated Claude Code against roughly 30 targets, are cited as evidence of the resulting exposure.

ARC combines three inputs: a GPA + IAT agency checklist adapted from Bommarito et al., Feng et al.'s five-level autonomy framework (L1 Operator to L5 Observer), and a twelve-dimension risk rubric scored 1 (Low) to 3 (High). A "critical dimension" rule keeps a single high score from being averaged away: any dimension at 3, or autonomy level L5, produces Tier 3, and multi-agent systems inherit the highest tier among their agents.

The output is a three-tier result — Tier 1 Low, Tier 2 Medium, Tier 3 High — mapped to Standard, Enhanced and Rigorous control catalogues. A Coding Assistant extension substitutes a 20-capability assessment for GPA + IAT and adds four deployment models and a 20-factor risk taxonomy, with illustrative profiles for seven agent types.

## 🧩 What’s Covered

- **Introduction and incident evidence:** describes the gap left by voluntary and pre-agentic frameworks and cites the GTG-1002 Claude Code campaign, the "IDEsaster" coding-tool vulnerabilities, and the Rules File Backdoor attack.
- **Background and related work:** reviews NIST AI RMF and its Generative AI Profile, the EU AI Act, ISO/IEC 42001, OWASP agentic guidance, MITRE ATLAS and SR 11-7/SR 26-2, plus adjacent work such as AURA, the Cloud Security Alliance CBRA and agent benchmarks.
- **Agentic AI taxonomy:** differentiates agent types along four axes — function and task domain, autonomy and human-in/on-the-loop characteristics, operating environment, and action authority and system reach — producing seven categories from autonomous agents to transaction/commerce agents.
- **Framework structure:** covers agent identification metadata, the GPA + IAT checklist (Goal, Perception, Action, Iteration, Adaptation, Termination), the L1–L5 autonomy assessment, the twelve-dimension rubric scored 1–3, and seven additional risk factors.
- **Tier determination and controls:** any dimension scoring 3 or autonomy level L5 gives Tier 3; a maximum of 2 or an average of at least 1.5 gives Tier 2; multi-agent systems inherit the highest tier among their agents. Tiers map to Standard, Enhanced and Rigorous control catalogues.
- **Coding Assistant extension:** replaces GPA + IAT with 20 discrete capabilities, adds four deployment models with expected tier mappings, and substitutes a 20-factor risk taxonomy in three categories: Supply Chain and Artifact Integrity, Agent Manipulation and Workflow Hijacking, and Access and Privilege Abuse.
- **Illustrative examples:** scores hypothetical profiles of all seven agent types, reporting totals from 14 to 28 and averages from 1.17 to 2.33, and shows the critical-dimension rule lifting decision support and tool-using agents to Tier 3.
- **Discussion and future work:** proposes embedding ARC in procurement gates, lifecycle reviews and deployment approvals, defends the critical-dimension rule against charges of over-restriction, and plans expansion to multi-agent systems, procurement and external exposure risk and industry tailoring.

## 💡 Why it matters?

Teams deploying agents need to decide, defensibly, how much oversight a given system requires. ARC turns broad, mostly voluntary guidance into a repeatable intake and scoring routine that produces a tier and a matching control set, so governance and model risk functions can apply the same instrument across systems rather than reasoning case by case. The authors note that SR 11-7 and SR 26-2 do not cover generative or agentic AI and that the EU AI Act predates agentic prevalence, positioning ARC as a complement to those regimes rather than a replacement. Its coding assistant extension addresses the supply-chain and executable-output risks of tools already in wide enterprise use.

## ❓ What’s Missing

The authors acknowledge that scoring remains subjective despite detailed rubrics, that the framework captures a static snapshot without tracking drift over the agent life-cycle, and that it may date quickly. Illustrative scores are hypothetical profiles rather than validated assessments, and additional risk factors are excluded from them. Multi-agent systems, procurement and external exposure risk, and industry-specific tailoring are deferred to future work, with the framework said to work best for financial services and healthcare. No external validation, inter-rater testing or legal analysis is presented, and the interactive framework is referenced without a printed URL in the extracted text.

## 👥 Best For

AI governance practitioners and risk officers running intake and tiering for agentic systems; model risk and compliance teams in financial services and healthcare mapping tiers to controls; platform and security engineers governing coding assistants; and regulators or policy staff wanting a concrete, control-mapped method for classifying agent deployments.

## 📄 Source Details

*TrustX Agent Risk Classification Framework (ARC): Risk-Tiering Internally Created Agentic AI Systems* by Hannah Liu (Responsible AI Institute; Imperial College London), Rhea Saxena and Shiv Asthana (Responsible AI Institute), dated July 13, 2026; marked arXiv:2607.09586v1 \[cs.AI\], 10 Jul 2026, and running to 15 pages including references and Appendix A. No publisher statement or document URL is printed; the extraction covered all 15 pages.