Agent Trust Scorecard
Are your AI agents trustworthy, safe, and secure?
10 questions. 3 minutes. A personalized report on whether your AI agents are trustworthy, safe, and secure for 2026 — graded against OWASP, NIST, and current agentic-AI best practice.
Want the identity checklist instead? See the Agent Identity Scorecard. This one grades the trust, safety, and security posture around your agents — runtime control, oversight, monitoring, and governance.
1 of 10 · runtime
Do high-impact or irreversible agent actions (payments, deletions, external comms, code execution) pass through a deterministic policy check or tool gateway before they run — not just the model's own judgment?
Models can be steered by injected instructions, so the consensus defense against tool misuse and goal hijack is to enforce what an agent may do outside the model, not to trust it to refuse.
2 of 10 · runtime
Have you inventoried every tool and action each agent can invoke, and classified them by impact and reversibility, with stricter controls on destructive or irreversible ones?
An agent's real risk comes from the tools it can reach. An irreversible action needs tighter control than a read-only one, and you cannot control what you have not catalogued.
3 of 10 · runtime
Can you immediately stop or suspend a misbehaving agent (kill-switch), and are there rate or scope limits that cap how much damage a runaway or compromised agent can do?
Without a fast stop and blast-radius limits, one compromised or drifting agent can cascade across a multi-agent workflow before anyone reacts.
4 of 10 · oversight
Is there a human approval checkpoint (or confidence-based escalation) before an agent takes high-impact, irreversible, or out-of-scope actions?
The EU AI Act requires oversight a human can actually enforce: the ability to override, interrupt, or stop must be built into the system, not just written in a policy.
5 of 10 · oversight
Does each agent have an explicit, documented autonomy level with defined conditions that trigger escalation to a human?
Matching oversight to an agent's autonomy — and reviewing that level against real behavior over time — prevents both over-restriction and unchecked action.
6 of 10 · monitoring
Do you monitor each agent's behavior in production against a baseline and get alerted on anomalies — unusual tool use, permission-escalation attempts, out-of-scope queries, or activity spikes?
Post-deployment behavioral telemetry is how you tell a healthy agent from one that is drifting, compromised, or operating outside its intended parameters.
7 of 10 · monitoring
Can you reconstruct, after the fact, the full chain of an agent's decision — the reasoning, tool calls with inputs and outputs, guardrail decisions, and any human approvals?
When something goes wrong, decision provenance answers "why did the agent do that?" and is increasingly required for audit and regulatory logging.
8 of 10 · monitoring
Are the agent's memory, retrieved context, and knowledge sources protected against poisoning or tampering?
Anything written into an agent's memory or context can silently steer all of its future decisions, which makes it a high-value target.
9 of 10 · governance
Do you adversarially test agents — including indirect prompt-injection and tool-abuse scenarios — before deployment and periodically after, using realistic attacks rather than textbook examples?
Robustness testing is now a documented expectation under NIST and the EU AI Act, and no prompt-injection defense generalizes without realistic red-teaming.
10 of 10 · governance
Does every agent have a named accountable owner, an incident-response playbook for agent-specific failures, and a clean decommissioning process (revoke access, dispose of learned state, preserve logs)?
Agent-specific incidents — hijack, runaway, delegation-chain compromise — need a pre-planned response and a clean shutdown; accountability has to be architected in from the start.
0 of 10 answered