Your AI Framework Is Fine. Your Vocabulary Is the Problem.
Why organizations need one risk taxonomy for Generative and Agentic AI, and how to build it in ninety days.
Three teams at the same organization described the same failure last quarter:
Model risk called it performance degradation.
Technology logged a service defect.
Compliance escalated a customer communication issue.
None of them were wrong. None of them could aggregate.
That is the quiet problem beneath most AI governance programs. We have the policies. We have the committees. We have an inventory somewhere. What we mostly do not have is a shared vocabulary for what can go wrong, which means the inventory cannot be queried, the incidents cannot be analyzed, and the board pack is an anecdote collection with a chart on the front.
A framework tells you what to do about risk. A taxonomy tells you what you are talking about. Most organizations have the first and are quietly missing the second.
Why the taxonomies we already have do not stretch
The reasonable instinct is to map AI into the operational risk taxonomy and the model risk framework. Right direction, wrong sufficiency.
Four things break:
The unit of analysis changed.Model risk taxonomies assume a defined input space, a measurable output and a validation cycle. An agentic system is not a model. It is a model plus tools plus memory plus retrieval plus a policy on when to stop. Classify that as "a model" and you have lost most of the risk before you start.
Failure stopped being binary.Availability, integrity and confidentiality are near-binary states. A generative system can be fully available, structurally intact and entirely wrong. Fluent, confident and incorrect has no natural home in an outage-centric taxonomy.
Risk lives in the composition.Slightly stale retrieval is a minor data issue. Mild over-summarization is a minor accuracy issue. Put them together in a client advisory workflow and you have a suitability problem that neither component contains on its own.
Autonomy removes the compensating control.Every risk category built for decision support assumes a human executes the decision. That human is the load-bearing wall behind most of our control designs. Agentic systems take the wall out, and a surprising amount of the framework was resting on it.
The answer is not to throw away what exists. It is to build an AI-native taxonomy that maps cleanly onto it, so AI risk can be described in AI terms to the people who need detail and in enterprise terms to the people who need the aggregate.
One taxonomy, seven layers:
The structure I have found workable follows a request through the system, from the data it draws on to the consequences of what it does.
Data and input.Provenance and rights, currency of retrieval sources, entitlement leakage, adversarial input. Prompt injections belong here rather than under cyber, because the attack vector is content, not infrastructure.
Model and system.Capability mismatch, silent drift, version and configuration change, reproducibility. A changed system prompt alters behavior as materially as a changed model and is almost never under equivalent control.
Output and content.Unsupported assertion, worth splitting into fabrication, misattribution and overstated confidence since the controls differ. Plus bias, disclosure defect, harmful content and confidentiality in output.
Interaction and human factors.Automation bias, nominal oversight, scope creep in use, shadow AI. The most under-specified layer in most organizations, and the one that explains a large share of real incidents.
Autonomy and action.Activates only when the system can act rather than advise. More on this below.
Supply chain and dependency.Provider change under a stable API, concentration where many vendors resolve to the same few foundation models, connector risk, contractual gaps, exit substitutability.
Enterprise and systemic.Regulatory exposure, legal liability, conduct and customer harm, reputational impact, capital treatment, and correlated risk where many firms run similar models on similar data.
Layers one to four apply to any generative deployment. Layer five switches on the moment the system can act. That single design choice, a common core with an autonomy layer rather than two separate taxonomies, is what stops you running two inventories and two sets of numbers that never reconcile.
Layer five is the part you cannot borrow
Everything else in the taxonomy has an ancestor somewhere in your existing frameworks. Layer five does not, because every framework you own assumes a person in the execution path.
Eight categories belong here:
Authority and scope:do the agent's permissions match the task it was given?
Action correctness:did the executed action match the intent? Correct reasoning, wrong record updated, is its own failure mode.
Reversibility:can the action be undone, and at what cost?
Orchestration and chaining:does a wrong intermediate result get carried confidently through six later steps?
Goal drift and persistence:do objectives distort across long-running tasks or persistent memory?
Multi-agent interaction:what emerges between agents, including loops and mutual escalation?
Accountability attribution:is there a named human owner for an action taken at three in the morning by a scheduled agent?
Containment and termination:can the agent be stopped cleanly mid-task?
Two of these get missed almost universally:
Reversibility should be assessed per action, not per system. An agent that reads freely, writes reversibly, and sends irreversibly needs three different control regimes, not one averaged regime.
Containment is not a kill switch. The real question is what state the process is left in when the agent stops halfway through a plan. Operations teams have dealt with partial failure for decades. AI governance has barely started asking the same question.
Agentic AI does not create a new risk universe. It removes the human control that most existing AI controls quietly depended on, and it widens the blast radius of everything already on the list.
What autonomy actually changes
Held against a generative deployment, the agentic version differs on six dimensions, and each one has a control consequence:
Input exposure.Generative inputs are user-supplied and observable at entry. Agentic inputs include tool outputs and prior steps, so untrusted content enters mid-process where nobody is looking.
System boundary.One model and one call becomes models, tools and memory composing behavior that no single component specifies.
Effect of error.A wrong output that a human reads becomes a wrong action already executed.
Human review.In the path by default becomes exception-based, so the design question shifts from quality of review to selection of what gets reviewed at all.
Blast radius.Bounded by the interaction becomes bounded only by the permissions granted.
Detection window.Visible at the point of use becomes visible only when downstream effects surface, which can be days.
Three things that turn a taxonomy into infrastructure
A taxonomy that lives only in the AI team is a glossary. Three moves make it load-bearing.
First, map every category outward. Data and input to data governance and privacy rules. Model and system to model risk. Output and content to conduct, fair lending and disclosure. Autonomy and action to operational risk and process controls. Supply chain to third-party and operational resilience. One classification, three audiences, no manual reconciliation when the examiner asks. Map to obligations rather than to regulators, since regulators change their instruments faster than obligations change in substance.
Second, pair it with tiering. Score four dimensions and take the highest rather than the average, so one severe dimension is not diluted: consequentiality (does the output affect a person's access, price or service), autonomy (how far can it act without approval), reversibility (can the effect be undone, and how cheaply), and exposure (who sees it, at what volume). Then treat a change in autonomy as a re-tiering event even when the model is unchanged. That is how agentic risk enters organizations: as an incremental permission granted to a system that was assessed when it could only advise.
Third, pressure test before you embed. Have three functions classify the same set of real incidents blind, then analyze the disagreements. If they classify the same incident three ways, the problem is the taxonomy, not the classifiers. It is far cheaper to learn that before the structure is wired into reporting than after two quarters of data have been collected against it.
Ninety days, if you want a sequence
Weeks 1 to 3.Collect thirty to fifty real incidents, near misses and audit findings from across the institution, including shadow usage. Let evidence constrain the design.
Weeks 4 to 6.Build the layers and categories, testing each against those incidents for exclusivity and observability.
Weeks 7 to 9.Map every leaf outward to operational risk, model risk and the relevant obligations.
Weeks 10 to 12.Run the blind classification test across three functions.
Week 13.Wire it into the inventory, the incident form and the control library. Name an owner and a change process, because it will be wrong in places within six months.
Where these projects die
Four patterns, all avoidable. Writing it in isolation, so the functions that must classify incidents never adopt it. Optimizing for completeness, producing ninety categories that no first-line manager can apply in under two minutes. Deferring the autonomy layer because "we have no agents in production," when the workflow automations have quietly acquired the ability to act. And leaving classification with no consequence, so nobody does it carefully. A taxonomy needs teeth to stay accurate.
The unglamorous point
Taxonomy work produces no demonstrable capability.It appears on no product roadmap. It is the easiest thing on the list to defer in favor of the next use case.
It is also the difference between an institution that can answer questions about its AI estate and one that can only describe individual systems. That difference becomes visible at exactly the moment it costs the most: during an examination, during an incident, or during a board challenge you did not see coming.
The firms doing this well do not have the most elaborate structures. Their taxonomy is short enough to be used, mapped well enough to be reported, and owned clearly enough to be maintained.
If your organization has already built one, I would be interested in what went into the autonomy layer, and what you deliberately left out.
Explore more: Start Here · Topics · Archive · About