# AI agent risk and controls planner

Free planner for AI agents. Describe what the agent reads and can do, and get its risk profile, the OWASP LLM risks that apply, a recommended starting autonomy level and the controls to put in place before launch.

URL: https://smallbaydigital.com/tools/agent-risk/  
Updated: 28 October 2026  
Publisher: SBD (smallbaydigital.com). Free, runs in the browser, nothing entered is stored on a server.

## In short

An AI agent’s risk comes from three things together: what it reads (untrusted content brings prompt injection), what it can do (write, send or pay brings excessive agency) and what a mistake costs. Start autonomy low, at the level where a person approves consequential actions, and raise it only on evidence from evaluation and live monitoring.

## How to use it

1. **Describe the agent.** Answer nine questions about what it reads, what it can do, the data it touches and what a mistake costs.
2. **Read the risk profile.** Four scores: injection exposure, agency, data sensitivity and impact.
3. **Check which OWASP risks apply.** The relevant entries from the OWASP Top 10 for LLM applications, 2025.
4. **Set the autonomy level.** Start at the recommended level on the five-level scale, with the ceiling it should not pass yet.
5. **Put the controls in place.** Work through the generated controls checklist before launch, and copy it into your launch plan.

## Worked example

An invoice agent reads supplier emails and PDFs from outside the company, creates draft bills in the accounting system, handles personal and payment data, and a mistake could pay the wrong account. Injection exposure and impact are high. The planner recommends starting at level 3 (consultant, drafting while a person decides), moving to level 4 (approver) only for low-value invoices after evaluation, and lists 18 controls, including validating every action it proposes outside the model, keeping payment data out of logs and tracking how often reviewers override it.

## Terms

- **Prompt injection:** Instructions hidden in input that change what a model does. Indirect injection arrives in content the agent reads, such as an email or web page. OWASP LLM01.
- **Excessive agency:** An agent with more functionality, permissions or autonomy than its task needs. OWASP LLM06.
- **Autonomy level:** How much the agent does without a person, defined here by the person’s role: operator, collaborator, consultant, approver or observer.
- **Evaluation set:** Real, labelled cases the agent must pass before launch and after every change.
- **Kill switch:** One control that stops the agent taking actions, known to the owner and tested.
- **Automation bias:** The tendency to accept a system’s output without checking it. Named in Article 14 of the EU AI Act.

## Sources

- OWASP, [Top 10 for Large Language Model Applications, 2025](https://genai.owasp.org/llm-top-10/). Prompt injection is LLM01, sensitive information disclosure LLM02, improper output handling LLM05, excessive agency LLM06 and unbounded consumption LLM10. Used for: The risk categories and the controls they map to.
- Feng, McDonald and Zhang, [Levels of Autonomy for AI Agents, 2025](https://arxiv.org/abs/2506.12469). Five levels defined by the user’s role: operator, collaborator, consultant, approver and observer, published in the Knight First Amendment Institute’s AI and Democratic Freedoms series. Used for: The five autonomy levels.
- NIST, [AI Risk Management Framework 1.0, 2023](https://www.nist.gov/itl/ai-risk-management-framework). A voluntary framework that ties the level of human oversight to the impact of an AI system’s decisions. Used for: Oversight tied to impact.
- European Commission, AI Act Service Desk, [Article 14: Human oversight](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-14). For high-risk systems, people overseeing them must be able to understand limits, interpret output, override or disregard it and stop the system, and be aware of automation bias. Used for: Oversight and automation bias controls.

## FAQ

### How risky is my AI agent?

Look at three things together: whether it reads content from outside your control, what it can do (read, draft, write, send, pay) and what a mistake costs. An agent that reads untrusted email and can send or pay is high risk however good the model is.

### What autonomy level should an AI agent start at?

Low enough that a person decides anything consequential. For most business agents that means drafting while a person decides, or acting only with approval, and moving up one level at a time once evaluation and live monitoring show it is reliable.

### Which OWASP risks apply to AI agents?

Most often prompt injection (LLM01), sensitive information disclosure (LLM02), improper output handling (LLM05), excessive agency (LLM06) and unbounded consumption (LLM10). Which apply depends on what the agent reads, what it can do and the data it touches.

### Does this tool make an agent compliant with the EU AI Act?

No. It plans controls drawn from public frameworks. Whether a system is high-risk under the AI Act, and what that requires, is a legal question for your adviser.