AI governance

AI Workflow Risk Checker

Use this before an AI agent or workflow touches real systems. The goal is not paperwork. It is finding the one risk that can wreck the launch.

Good fit

Agents, copilots, customer ops, internal automations.

Touches private customer, employee, or financial dataData exposure and retention questionsCan send emails, update systems, publish, or trigger paymentsBad actions can leave the draft environmentReads web pages, files, tickets, emails, or user uploadsPrompt injection can influence behaviorNo approval gate before important actionsHumans cannot stop high-impact mistakesUses broad API keys or shared admin credentialsOne workflow can overreach across systemsTool calls and outputs are not logged clearlyIncidents become hard to diagnoseNo rollback or retry plan existsPartial failures turn into manual cleanupNo named business/process ownerNobody maintains the workflow after launch

Treat the score as a launch gate

Any checked item can still be acceptable if it has a control: least-privilege credentials, approval gates, clear logs, rollback steps, and a named owner.

Request a workflow audit Read workflow guides

Review packet

AI Workflow Risk Register

A lightweight register for tracking prompt injection, privacy, external actions, approval gates, and monitoring gaps before an AI workflow goes live.

Risk review worksheet for AI automations. Updated with AI automation risk coverage.

Run an automation audit