Free tool
Plan the safeguards before your AI agent goes live.
Describe what the agent reads, what it can do and what a mistake costs. Get its risk profile, the OWASP risks that apply, where to set its autonomy, and the controls to put in place first.
Plan an agentFree, no sign-up Updated Method and sources Markdown version
- L5ObserverThe agent acts alone; the person monitors. Not yet
- L4ApproverThe agent acts; the person approves risky or set actions. Ceiling for now
- L3ConsultantThe agent leads and drafts; the person decides. Start here
- L2CollaboratorPerson and agent share the work, step by step.
- L1OperatorThe person drives; the agent helps when asked.
Summary and how to use it
In short
An AI agent’s risk comes from three things together: what it reads (untrusted content brings prompt injection), what it can do (write, send or pay brings excessive agency) and what a mistake costs. Start autonomy low, at the level where a person approves consequential actions, and raise it only on evidence from evaluation and live monitoring.
Worked example
An invoice agent reads supplier emails and PDFs from outside the company, creates draft bills in the accounting system, handles personal and payment data, and a mistake could pay the wrong account. Injection exposure and impact are high. The planner recommends starting at level 3 (consultant, drafting while a person decides), moving to level 4 (approver) only for low-value invoices after evaluation, and lists 18 controls, including validating every action it proposes outside the model, keeping payment data out of logs and tracking how often reviewers override it.
How to use it
- 1Describe the agent
Answer nine questions about what it reads, what it can do, the data it touches and what a mistake costs.
- 2Read the risk profile
Four scores: injection exposure, agency, data sensitivity and impact.
- 3Check which OWASP risks apply
The relevant entries from the OWASP Top 10 for LLM applications, 2025.
- 4Set the autonomy level
Start at the recommended level on the five-level scale, with the ceiling it should not pass yet.
- 5Put the controls in place
Work through the generated controls checklist before launch, and copy it into your launch plan.
Planner
Describe the agent.
Choose the answer that describes the agent at its most capable. The plan updates as you go and is saved in this browser.
Controls
0 controls to put in place.
Generated from your answers. Each is tagged with the OWASP risk or framework it answers. Copy the list into your launch plan.
Autonomy levels
Five levels, defined by the person’s role.
From Feng, McDonald and Zhang, Levels of Autonomy for AI Agents (2025). Start low and move up one level at a time, on evidence.
- L1Operator
The person drives; the agent helps when asked.
- L2Collaborator
Person and agent share the work, step by step.
- L3Consultant
The agent leads and drafts; the person decides.
- L4Approver
The agent acts; the person approves risky or set actions.
- L5Observer
The agent acts alone; the person monitors.
Method
How the plan is worked out.
Start level: low risk L4, medium L3, high L3, or L2 if it can send externally or move money. No test set caps the start at L3. Ceiling: L5 only for low risk with reversible, low-cost actions; regulated or high-impact work stays at L4 or below.
| Score | From |
|---|---|
| Injection exposure | What it reads (70%) and whether the public interacts with it (30%). |
| Agency | The most it can do (80%) and whether actions can be undone (20%). |
| Data sensitivity | The most sensitive class of data it handles. |
| Impact | Cost of a mistake (50%), reversibility (25%) and regulated domain (25%). |
| Overall tier | Weighted 30/30/15/25. High if 60 or more, or if injection exposure and agency are both high, since that pair is what turns an injected instruction into an action. |
| OWASP | Risk |
|---|---|
| LLM01 | Prompt injection. Instructions hidden in input change what the model does. |
| LLM02 | Sensitive information disclosure. Personal or confidential data leaks through prompts, outputs or logs. |
| LLM05 | Improper output handling. Model output used downstream without validation. |
| LLM06 | Excessive agency. More functionality, permissions or autonomy than the task needs. |
| LLM10 | Unbounded consumption. Runaway usage, cost or denial of service. |
Sources
Where the numbers come from.
Each default and rule is traced to a published source, or labelled as practitioner guidance where no audited benchmark exists.
- OWASP Top 10 for Large Language Model Applications, 2025Used forThe risk categories and the controls they map to
Prompt injection is LLM01, sensitive information disclosure LLM02, improper output handling LLM05, excessive agency LLM06 and unbounded consumption LLM10.
- Feng, McDonald and Zhang Levels of Autonomy for AI Agents, 2025Used forThe five autonomy levels
Five levels defined by the user’s role: operator, collaborator, consultant, approver and observer, published in the Knight First Amendment Institute’s AI and Democratic Freedoms series.
- NIST AI Risk Management Framework 1.0, 2023Used forOversight tied to impact
A voluntary framework that ties the level of human oversight to the impact of an AI system’s decisions.
- European Commission, AI Act Service Desk Article 14: Human oversightUsed forOversight and automation bias controls
For high-risk systems, people overseeing them must be able to understand limits, interpret output, override or disregard it and stop the system, and be aware of automation bias.
Terms
What the terms mean.
- Prompt injection
- Instructions hidden in input that change what a model does. Indirect injection arrives in content the agent reads, such as an email or web page. OWASP LLM01.
- Excessive agency
- An agent with more functionality, permissions or autonomy than its task needs. OWASP LLM06.
- Autonomy level
- How much the agent does without a person, defined here by the person’s role: operator, collaborator, consultant, approver or observer.
- Evaluation set
- Real, labelled cases the agent must pass before launch and after every change.
- Kill switch
- One control that stops the agent taking actions, known to the owner and tested.
- Automation bias
- The tendency to accept a system’s output without checking it. Named in Article 14 of the EU AI Act.
FAQ
Questions about AI agent risk.
How risky is my AI agent?
Look at three things together: whether it reads content from outside your control, what it can do (read, draft, write, send, pay) and what a mistake costs. An agent that reads untrusted email and can send or pay is high risk however good the model is.
What autonomy level should an AI agent start at?
Low enough that a person decides anything consequential. For most business agents that means drafting while a person decides, or acting only with approval, and moving up one level at a time once evaluation and live monitoring show it is reliable.
Which OWASP risks apply to AI agents?
Most often prompt injection (LLM01), sensitive information disclosure (LLM02), improper output handling (LLM05), excessive agency (LLM06) and unbounded consumption (LLM10). Which apply depends on what the agent reads, what it can do and the data it touches.
Does this tool make an agent compliant with the EU AI Act?
No. It plans controls drawn from public frameworks. Whether a system is high-risk under the AI Act, and what that requires, is a legal question for your adviser.
More free tools
More free tools
- Automation and AI ROI calculatorFree, vendor-neutral automation and AI ROI calculator. Any pricing model, loaded labour cost, risk adjustment, NPV, IRR, discounted payback, scenarios and sensitivity, with the method and sources shown.Open the tool
- Automation opportunity mapperFree, vendor-neutral automation opportunity mapper. Score each process on impact and ease, plot them on a 2×2, get a ranked roadmap and the right approach for each, with the method and sources shown.Open the tool
- Build vs buy decision toolFree, vendor-neutral build vs buy tool. Compare buying software, configuring a low-code platform and building custom on a weighted scorecard and a discounted three-year total cost of ownership, with the method and sources shown.Open the tool
- AI readiness assessmentFree AI readiness self-assessment across strategy, infrastructure, data, governance, talent and culture, the six pillars of the Cisco AI Readiness Index. 24 questions, a radar chart, a readiness stage and the next steps for your weakest pillars.Open the tool
- All free toolsEvery calculator and planner, with its method and sources.See all