Anthropic's deputy chief information security officer has laid out a four-question framework designed to help organizations assess risks tied to agentic AI — systems that can act autonomously. The framework, shared during a recent briefing, zeroes in on governance and the growing complexity of model intelligence.
Four questions for agentic AI
The framework asks teams to evaluate four key areas before deploying or updating agentic systems. While the exact questions were not detailed in the public summary, the deputy CISO emphasized that they are meant to guide risk assessments rather than replace existing security checklists. The goal is to catch potential failures early, especially as AI agents gain more decision-making power.
Governance at the center
Governance features prominently in the approach. The framework urges companies to think about who oversees the AI, what guardrails are in place, and how accountability is assigned when an agent acts on its own. Without clear governance structures, the deputy CISO warned, even well-intentioned agents can drift into risky territory.
Why model intelligence matters
A second pillar of the framework addresses how rapidly evolving model intelligence changes the risk picture. As models become more capable, their behavior can shift in unpredictable ways — what worked safely last month might not work today. The framework suggests regular reassessment tied to model updates, not just at initial deployment.
The deputy CISO didn't offer a one-size-fits-all solution, but argued that a structured set of questions can keep teams focused on the most pressing unknowns. The approach is meant to complement existing AI safety practices, not replace them.
For now, the framework remains a proposal. Anthropic has not announced whether it will be published as a formal guide or integrated into its own products. But the questions it raises — about control, oversight, and the pace of change — are ones that any organization building agentic AI will have to answer sooner or later.
