⚡ Quick Summary
Published by the Responsible AI Institute, this paper presents the TrustX Agent Risk Classification Framework (ARC), a structured, repeatable instrument for risk-tiering internally created agentic AI systems. Its premise is that general-purpose frameworks — NIST AI RMF, ISO/IEC 42001, OWASP agentic guidance, MITRE ATLAS, SR 11-7 and SR 26-2, and the EU AI Act — do not adequately scope agentic AI, whether because they are voluntary, predate its prevalence, or explicitly exclude generative and agentic systems. Disclosed incidents, including the GTG-1002 campaign that manipulated Claude Code against roughly 30 targets, are cited as evidence of the resulting exposure.
ARC combines three inputs: a GPA + IAT agency checklist adapted from Bommarito et al., Feng et al.'s five-level autonomy framework (L1 Operator to L5 Observer), and a twelve-dimension risk rubric scored 1 (Low) to 3 (High). A "critical dimension" rule keeps a single high score from being averaged away: any dimension at 3, or autonomy level L5, produces Tier 3, and multi-agent systems inherit the highest tier among their agents.
The output is a three-tier result — Tier 1 Low, Tier 2 Medium, Tier 3 High — mapped to Standard, Enhanced and Rigorous control catalogues. A Coding Assistant extension substitutes a 20-capability assessment for GPA + IAT and adds four deployment models and a 20-factor risk taxonomy, with illustrative profiles for seven agent types.
🧩 What’s Covered
- Introduction and incident evidence: describes the gap left by voluntary and pre-agentic frameworks and cites the GTG-1002 Claude Code campaign, the "IDEsaster" coding-tool vulnerabilities, and the Rules File Backdoor attack.
- Background and related work: reviews NIST AI RMF and its Generative AI Profile, the EU AI Act, ISO/IEC 42001, OWASP agentic guidance, MITRE ATLAS and SR 11-7/SR 26-2, plus adjacent work such as AURA, the Cloud Security Alliance CBRA and agent benchmarks.
- Agentic AI taxonomy: differentiates agent types along four axes — function and task domain, autonomy and human-in/on-the-loop characteristics, operating environment, and action authority and system reach — producing seven categories from autonomous agents to transaction/commerce agents.
- Framework structure: covers agent identification metadata, the GPA + IAT checklist (Goal, Perception, Action, Iteration, Adaptation, Termination), the L1–L5 autonomy assessment, the twelve-dimension rubric scored 1–3, and seven additional risk factors.
- Tier determination and controls: any dimension scoring 3 or autonomy level L5 gives Tier 3; a maximum of 2 or an average of at least 1.5 gives Tier 2; multi-agent systems inherit the highest tier among their agents. Tiers map to Standard, Enhanced and Rigorous control catalogues.
- Coding Assistant extension: replaces GPA + IAT with 20 discrete capabilities, adds four deployment models with expected tier mappings, and substitutes a 20-factor risk taxonomy in three categories: Supply Chain and Artifact Integrity, Agent Manipulation and Workflow Hijacking, and Access and Privilege Abuse.
- Illustrative examples: scores hypothetical profiles of all seven agent types, reporting totals from 14 to 28 and averages from 1.17 to 2.33, and shows the critical-dimension rule lifting decision support and tool-using agents to Tier 3.
- Discussion and future work: proposes embedding ARC in procurement gates, lifecycle reviews and deployment approvals, defends the critical-dimension rule against charges of over-restriction, and plans expansion to multi-agent systems, procurement and external exposure risk and industry tailoring.
💡 Why it matters?
Teams deploying agents need to decide, defensibly, how much oversight a given system requires. ARC turns broad, mostly voluntary guidance into a repeatable intake and scoring routine that produces a tier and a matching control set, so governance and model risk functions can apply the same instrument across systems rather than reasoning case by case. The authors note that SR 11-7 and SR 26-2 do not cover generative or agentic AI and that the EU AI Act predates agentic prevalence, positioning ARC as a complement to those regimes rather than a replacement. Its coding assistant extension addresses the supply-chain and executable-output risks of tools already in wide enterprise use.
❓ What’s Missing
The authors acknowledge that scoring remains subjective despite detailed rubrics, that the framework captures a static snapshot without tracking drift over the agent life-cycle, and that it may date quickly. Illustrative scores are hypothetical profiles rather than validated assessments, and additional risk factors are excluded from them. Multi-agent systems, procurement and external exposure risk, and industry-specific tailoring are deferred to future work, with the framework said to work best for financial services and healthcare. No external validation, inter-rater testing or legal analysis is presented, and the interactive framework is referenced without a printed URL in the extracted text.
👥 Best For
AI governance practitioners and risk officers running intake and tiering for agentic systems; model risk and compliance teams in financial services and healthcare mapping tiers to controls; platform and security engineers governing coding assistants; and regulators or policy staff wanting a concrete, control-mapped method for classifying agent deployments.
📄 Source Details
TrustX Agent Risk Classification Framework (ARC): Risk-Tiering Internally Created Agentic AI Systems by Hannah Liu (Responsible AI Institute; Imperial College London), Rhea Saxena and Shiv Asthana (Responsible AI Institute), dated July 13, 2026; marked arXiv:2607.09586v1 [cs.AI], 10 Jul 2026, and running to 15 pages including references and Appendix A. No publisher statement or document URL is printed; the extraction covered all 15 pages.
