# AI Risk Register
Executive Summary
This risk register converts AI security concern into owned work. It prioritizes risks by impact, likelihood, owner, decision state, remediation plan, evidence, and validation status.
The main conclusion is that the product can continue controlled pilot use, but enterprise expansion should be tied to proof of retrieval authorization, agent action-class enforcement, approval context, and AI trace governance.
Public sample notice
Executive risk decision
Accept limited pilot exposure only while critical tool execution remains blocked and the first remediation wave is completed. Do not expand enterprise rollout until the critical and high-risk items have owners, dates, evidence, and retest results.
Risk Register Snapshot
Risk must become work
Register
AI Risk Register
The register tracks the highest-priority AI security risks for a customer-facing copilot using RAG, model-provider routing, tool access, approval workflows, and AI trace logging.
Highest-priority risks
Priority Risk Findings
Retrieval can expose content the user cannot access directly
The retrieval layer uses tenant and source filters, but the evidence does not yet prove authorization survives indexing, chunking, semantic retrieval, reranking, and prompt assembly.
Why this is critical
Agent tool authority can exceed the intended user action
Tool access is not yet consistently separated into read, suggest, draft, queue, approve, and execute action classes. Without that separation, blast radius is hard to bound.
Human approval lacks enough context to be meaningful
Approval screens do not always show the evidence, target object, before/after diff, model rationale, blast radius, and rollback path needed for meaningful review.
AI traces may store sensitive customer and operational data
Prompts, retrieved snippets, outputs, tool calls, and approval records may contain customer-sensitive information. They need explicit classification, retention, access control, redaction, and incident-response treatment.
Executive decisions
Executive decision table
| Decision | Status | Rationale |
|---|---|---|
| Pilot expansion | Conditional | allowed after retrieval and action-class controls are complete |
| Enterprise review | Conditional | acceptable if partial controls are disclosed through evidence pack |
| Critical tool actions | Blocked | execution remains blocked until approval and trace controls are validated |
Critical tool execution remains blocked
Customer-visible, billing-impacting, destructive, privileged, or third-party webhook execution should remain blocked until approval bundles and trace evidence are validated.
Remediation roadmap
Risk remediation roadmap
| Priority | Work item | Owner | Target |
|---|---|---|---|
| 1 | Prove retrieval authorization | Search Platform | 2026-06-15 |
| 2 | Enforce agent action classes | AI Platform Engineering | 2026-06-20 |
| 3 | Upgrade approval context | Product Operations | 2026-06-25 |
| 4 | Classify AI traces | Security Engineering | 2026-06-30 |
| 5 | Make AI abuse tests release gates | Product Security | 2026-07-05 |
Risk operating rules
Evidence map
Risk evidence map
The risk evidence map links each risk to the artifact that proves current state or validates remediation.
Operating model implication
Related artifact: Enterprise AI Security Evidence Pack
The evidence pack turns risk register outputs into buyer-ready answers for procurement and security review.