GCRI · زیرەکی دەستکرد و سیستەمە خۆسەرەکان
سیستەمە ئەیجێنتییەکان
Agentic AI سیستەمە pursue goals by planning and taking actions: calling tools, browsing, writing and running code, or operating other software, sometimes over long tasks with little supervision. Autonomy brings usefulness and new failure modes, from compounding errors to misuse of granted permissions. This page sets out how agents fail, how their actions can be bounded and overseen, and what evidence serves those who build, deploy and govern them.
Agentic systems on the record.
Agentic systems: how the risk develops.
Tool access, delegated authority and safe execution. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Errors compound over steps
Each step in a long task can go wrong, and an early mistake shapes later actions. Small per-step error rates add up over many steps.
Permissions define the blast radius
An agent can only do harm with the access it has been given. Broad credentials, write access and payment rights turn errors or manipulation into real-world consequences.
Untrusted inputs steer behaviour
Agents read web pages, documents and messages that may contain instructions. Prompt injection can redirect an agent to act against its user.
Oversight must be designed in
Humans cannot review every action of a fast agent. Approval steps for consequential actions, logging and the ability to stop and roll back are design choices.
Agent oversight console.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Agent oversight console
Agentic systems · Agent sandbox · Session AG-6627
Tool calls
- 10:34زانیاریsearch(documents) · read-only
- 10:51زانیاریrun_model(flood_nowcast) · sandbox
- 10:51دەروازەsend_message(external) · needs approval
- 10:53Errorwrite_file(outside workspace) · denied
سیاسەت
- سنوور
- workspace only
- External actions
- human approval
- Spend limit
- 43 units
- Kill switch
- Armed
Actions by approval class
Agents that act need guardrails in every domain they touch.
- وزەهاوبەستیAutomated control of grids needs strict human oversight.What to watchOverride and rollback design
- تەندروستیهاوبەستیAgents handling health data raise privacy and safety risks.What to watchAccess scopes and logs
- ئاوهاوبەستیAutomation of utility operations must fail safe.What to watchFail-safe behaviour
Agentic system studies are designed for the زنجیرەی Exponential Technology. The OWASP Top 10 for LLM applications lists failure modes such as excessive agency and prompt injection; the page describes them without exploit detail.
- Incident reports involving agents.
- Designs for oversight and permission scoping.
How agentic systems is modelled, measured and tested.
مۆدێلەکە، گریمانەکانی، داتاکانی و نادڵنیاییەکەی، بەو شێوەیەی زانا یان ئەندازیارێک دەیپشکنێت. پێکهاتەکان ڕێگا بڵاوکراوەکان دەگرنەبەر. بەهاکانی کێشراو نموونەییە، نەک دۆزینەوە.
مۆدێلی سیستەم
The couplings between the systems in agentic systems: signs of influence, a reinforcing and a balancing loop, and cross-links where stress jumps.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | ناونیشان |
|---|---|---|---|---|
| Task success rate on agent benchmarks | percent of tasks completed correctly | per evaluation | Agent benchmark results | REPORTED |
| Actions requiring human approval | percent of consequential actions | per deployment | Deployment configuration | DECLARED |
| Prompt injection success rate | percent of attempts succeeding | per evaluation | Security testing | چاودێریکراو |
| Agent incidents | count by severity | monthly | Incident reports | REPORTED |
| Actions logged and attributable | percent of agent actions | per deployment | Audit logs | چاودێریکراو |
| Mean task length before human intervention | steps or minutes | per evaluation | Evaluation logs | چاودێریکراو |
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| سەرچاوە | What it gives | Licence class |
|---|---|---|
| OWASP Top 10 for LLM Applications and agentic security guidance | Risks such as prompt injection and excessive agency | Open, CC BY-SA 4.0 |
| Published agent benchmarks such as SWE-bench and related suites | Task-based evaluation of agents | Open, licence per benchmark (to check) |
| NIST AI Risk Management Framework | Practices for governing and measuring AI risk | Public domain, US government |
| AI Incident Database | Reported incidents involving AI سیستەمە | Open, licence to check |
| Developer system cards describing agent safeguards | Developer-reported agent evaluations and controls | Public documents, terms per developer |
Who decides, and what the evidence serves.
زیرەکی دەستکرد و سیستەم prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| کێ بڕیار دەدات | The question | Evidence this page serves |
|---|---|---|
| Deploying organisations | Which actions an agent may take alone and which need approval | Permission patterns; evaluation results |
| Security teams | How to protect agents from manipulation | Injection testing; incident evidence |
| Regulators | What oversight to require for autonomous AI actions | Oversight design evidence |
Outputs this topic produces
- Permission and approval design patterns for agents
- Agent evaluation protocols covering long tasks
- Prompt injection test suites for deployments
- Logging and rollback requirements
What designers and evaluators ask.
- What actions can the agent take, with whose authority, and which are reversible?
- How does it behave when instructions are ambiguous, conflicting or malicious?
- Can a human see what it is doing, understand why and stop it in time?
- How do errors compound over long sequences of steps?
How agents fail.
An agent combines a model’s reasoning with permissions in the world. Small errors in early steps can compound across a long task. Agents can misinterpret goals, pursue them in unintended ways or take shortcuts that satisfy a metric but not the intent. Content the agent reads, such as a web page or document, can contain instructions designed to hijack it, an attack known as prompt injection.
The more permissions an agent holds, the larger the potential harm. سیستەم that coordinate several agents add further failure modes, as agents pass errors to each other or interact in unforeseen ways.
Designing for safe execution.
- 01
Least privilege
Granting only the permissions a task needs, with sandboxes and spending or action limits, drawing on ئاسایشی سایبەری و نهێنینووسی.
- 02
Human oversight points
Requiring confirmation for consequential or irreversible actions. Too many prompts lead to rubber-stamping, so placement matters.
- 03
Task-based evaluation
Testing agents on realistic multi-step tasks in controlled environments, using ئەندازیاری هەڵسەنگاندن و دڵنیایی لە زیرەکی دەستکرد. Simulated environments miss some real-world complexity.
- 04
Logging and audit
Recording actions and reasoning traces so incidents can be reconstructed. Traces may not fully reflect how a model reached a decision.
How it is studied, and what the methods cannot say.
- 01ئەندازیاری هەڵسەنگاندن و دڵنیایی لە زیرەکی دەستکردAssurance cases for AI systems · Structured red teaming · Post-deployment monitoringApplied here
- 02ئاسایشی سایبەری و کریپتۆگرافیThreat modelling AI applications · Model supply chain integrity · Injection defence testingApplied here
- 03زیرەکی دەستکرد و فێربوونی ماشێنDistribution shift analysis · Fine-tuning for a specific use · Interpretability methodsApplied here
- 04ئەگەر و ئامارUncertainty on benchmark scores · Calibration assessment · Audit samplingApplied here
Where this page’s references lead.
ئەو لەش و بەڵگەنامانەی ئەم لاپەڕەیەیان لەگەڵ دەخوێنرێتەوە. دۆخ و وەشانەکان دەگۆڕێن؛ هەر بەستەرێک دەچێتە لای لەشی دەرکەر.
پرسیار و وەڵام.
What is an AI agent?
What is prompt injection?
How can agent risk be reduced?
Should agents ever act without human approval?
Can agents be evaluated before deployment?
Does the platform build agents?
لەم لاپەڕەیەوە بەڵگە پێشکەش بکە.
Reports is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- ئیمەیڵدەروازەی GW-GCRIلەم لاپەڕەیەوە بینێرەبەڵگە، ڕاستکردنەوە، بابەت، ڕێگا، پێداچوونەوە، وەرگێڕان یان تێکردنی پڕۆفایل. بە نیشانەی ئەم لاپەڕەیە دەگات، بۆ ئەوەی دەستکاریکەری خاوەنەکەی وەریبگرێت.
- Zenodoتەکیەی کراوەدایبنێ و بیدە بە کۆمەڵگاتۆماری خۆت لە Zenodo بە ORCID iD ی خۆت بڵاو بکەرەوە، پاشان لەوێ بیدە بە کۆمەڵگای Reports. سەرپەرشتیارەکان پێداچوونەوەی بۆ دەکەن؛ DOI هەر هی تۆیە.
- ReportsGCRIهەموو ڕێگاکانی بەشداری ببینەجۆرەکانی بەشداری، هەریەکە چۆن پێداچوونەوەی بۆ دەکرێت، چ ناوبردنێک وەردەگریت، مۆڵەتەکە و ئەوەی هەرگیز وەرناگیرێت.
هەرگیز داتای کەسی، وردەکاریی هەستیاری ژێرخان یان هیچ شتێک مەنێرە کە مافی بڵاوکردنەوەت نییە. بەشدارییەک پێش بەکارهێنان پێداچوونەوەی بۆ دەکرێت؛ ناردنی ماف نابەخشێت بە نووسەرایەتی یان بەڕێوەبردنی ڕاگەیاندن، و پاڵپشتی دارایی هەرگیز دۆزینەوەیەک ناکڕێت.
ڕێگایەک، کۆمەڵە داتایەک یان پرسیارێک بهێنە.
زانیاری و پرسیار ئەمڕۆ کراوەن. پرسیارێک ژمارەی ئاماژەی پێدەدرێت و هەنگاوی دواتر دیاری دەکات؛ داواکاری، پارەدان، تەرخانکردنی کۆمپیوتەر و تۆمارکردن تەنیا کاتێک دەکرێنەوە کە تیم، مەرج و توانای پێداچوونەوەیان هەبێت.
بەڵگەنامە یاساییەکان.
نەخشە، داتا و وێنەکانی ئەم ماڵپەڕە بۆ ناوەڕۆک و زانیاریی گشتی پیشان دراون. ئامۆژگاری، پێشبینی یان ئاگادارکردنەوە نین؛ سنوورەکانی زانیارییەکە لە ڕەتکردنەوەی بەرپرسیارێتی و ئاگاداریی داتادا دەستنیشان کراون.