# AI agent risk scorecard Ten yes / partly / no questions: 1. Do you have an up-to-date inventory of every AI agent, copilot and AI-powered automation in the organisation? 2. Does each agent have its own identity with least-privilege access to tools and data? 3. Is sensitive and personal data classified, and blocked from agents that should not see it? 4. Do material actions such as payments, approvals and customer changes require human approval? 5. Is every agent action logged with enough detail for an audit? 6. Have your agents been tested against prompt injection and the OWASP Top 10 for LLM applications? 7. Do you assess the risk of AI vendors, models and plugins before they are connected? 8. Can you detect and stop a misbehaving agent quickly, with runtime monitoring and a kill switch? 9. Have you mapped your AI use to the regulations that apply to you, such as UAE PDPL, DIFC, India's DPDP Act or ISO/IEC 42001? 10. Is there a named owner and a governance forum for AI risk?