Anthropic CISO's Four-Question Framework
for Agentic AI Risk

In July 2026, Anthropic's Deputy CISO Timothy Morano published a concise yet profound framework for assessing agentic AI risk. This is not a dozens-of-pages technical architecture checklist — it's four questions. Four questions that cut to the essence of agent risk, helping enterprises ask the most critical questions before deploying agents.

Framework Background

Before this framework, agentic AI risk assessment methods generally fell into two categories: overly technical architecture checklists (like OWASP's Top 10 Agentic Risks) or overly abstract governance principles (like "ensure AI systems are safe"). The former lacked strategic perspective; the latter lacked operational applicability.

Anthropic's CISO team took a middle path — four questions, each representing an independent risk dimension. This is not a replacement for technical checklists, but a strategic context for them. Enterprises should use these four questions to build risk awareness first, then dive into specific technical controls.

Question 1: What Is the Agent Trusted to Do?

The first and most fundamental question. Not "what can the agent do" but "what do we trust the agent to do" — this is a permissions question.

The key distinction: capability is what the agent can do (the model's technical ceiling), while trust is what the enterprise allows the agent to do (the governance boundary). The gap between the two is the risk exposure.

• Read data: What data sources can the agent read? Do they contain PII or trade secrets?
• Write data: What systems can the agent write to? Do write operations require human approval?
• Execute actions: What actions can the agent perform — send emails, submit code, execute trades, delete records?
• Delegate tasks: Can the agent create sub-agents? What are the sub-agents' permission boundaries?

Morano emphasizes: the answer to this question cannot be "all necessary permissions." If the answer is "all necessary permissions," it means you haven't truly thought about trust boundaries. Every permission should have a clear rationale and an upper limit.

Question 2: What Environment Does the Agent Operate In?

The second question focuses on the agent's operating context. The same agent in different environments has completely different risk profiles.

• Isolated vs. production environment: Is the agent running in a sandbox or directly connected to production systems?
• Data access scope: How large is the dataset the agent can access? A single database or an entire data lake?
• External connectivity: Can the agent access the internet? Can it call external APIs?
• Multi-tenant isolation: If the agent serves multiple customers, what is the tenant isolation mechanism?
• Audit coverage: Is logging complete in the environment? Can every agent action be traced?

The significance of this question: many agent risks arise not because the agent itself is flawed, but because the agent was deployed in an unsuitable environment. An agent that is safe in an isolated test environment can become dangerous in production — not because the agent changed, but because the environment changed.

Question 3: What's the Worst That Could Happen If the Agent Fails?

The third question is the most commonly overlooked. Enterprises tend to ask "will the agent work correctly" but rarely ask "if the agent fails, how bad could it get."

This is not pessimism — it's the fundamentals of risk management. Every agent should have a clear "worst-case analysis":

• Financial loss: If the agent executes a wrong transaction, what is the maximum loss?
• Data breach: If the agent exposes sensitive data to the wrong person, what is the scope of impact?
• Compliance violation: Which regulation would the agent's behavior violate? What is the fine?
• Reputational damage: If the agent's behavior becomes public, what is the brand impact?
• Cascading effects: Could the agent's failure trigger cascading failures in other systems?

Morano notes: if the severity of the worst case exceeds what the enterprise is willing to accept, the agent should not run without additional safeguards. This conclusion sounds simple, but many enterprises only realize how bad the "worst case" is after the agent has already caused harm.

Question 4: Can We Detect and Stop Abnormal Agent Behavior?

The fourth question focuses on runtime controls and observability. No matter how well you've prepared for the first three questions, the agent may still behave in ways you didn't anticipate.

• Real-time monitoring: Is there a real-time behavioral monitoring system? Can it detect anomalies within seconds?
• Anomaly detection: Is there a defined baseline of "normal behavior"? Is there an alerting mechanism for deviations?
• Intervention capability: Once an anomaly is detected, can the agent's operations be stopped immediately? Has the Kill Switch been tested?
• Rollback mechanism: If the agent performed irreversible operations, is there a disaster recovery and restoration plan?
• Human takeover: If automated intervention fails, is the human takeover process clear?

The core of this question: do not assume the agent will always work as expected. You need detection capability, stopping capability, and recovery capability.

The Value of the Framework: From "What Can the Agent Do" to "What Should the Agent Do"

The four-question framework is valuable because it changes how we assess agent risk. Traditional risk checklists ask "what can the agent do" — a technical question. Anthropic's framework asks "what should the agent be allowed to do" — a governance question.

The distinction is subtle but important: capability is the technical ceiling; trust is the governance boundary. When the governance boundary is clear, technical capability is no longer a risk — it's a known variable.

This framework is not one-time either. As agent capabilities improve, deployment scope expands, and environments change, the answers to all four questions need to be revisited. Agent governance is not a single audit — it is an ongoing process.

The Bottom Line

In an industry where 573 enterprises have deployed agents without controls, a concise assessment framework is more useful than a thousand pages of compliance documentation. Anthropic's four-question framework won't tell you how to configure every technical control — but it will ensure you ask the right questions before deploying an agent.

Because the first step of governance is not finding answers — it's asking the right questions.