Yes, though not for the obvious reason. Risk managers seldom approve individual agent drafts. They approve the conditions agents act under: depth increases, changes to the business's limits, and whether an agent goes back into service after an incident. Those decisions shape every action that follows. The certificate should prove the risk manager can read the evidence behind them.
What do risk managers actually approve?
In a governed operation, a risk manager is the second line. They challenge rather than run. When agents arrive, that challenge attaches to a new set of decisions:
- Depth changes. An operations team asks for an agent to move from drafting refunds (depth 2) to executing them within a limit (depth 3). Depth is earned, not configured: the agent's role sets the ceiling, evidence from certification sets the depth, and the lower wins. The risk manager should check that evidence before agreeing.
- Limit changes. Raising the amount an agent can act on within its depth.
- Return to service. After a certification run that clears no depth, an agent drops to depth 1 the same day. Someone must decide when it is ready to act again, and on what evidence.
- Exceptions to policy. A business owner asks to let an agent act in a new market or product before it has been certified there.
Each of these looks like an administrative approval. In practice it is a risk acceptance, and it is the kind an auditor will ask about first.
What should the agent provide, and what stays with the risk manager?
| Decision | What the agent or system supplies | What the risk manager decides |
|---|---|---|
| Depth increase | Certification results by gate: grounded, refuses, depth, escalates, scope, adversarial, stable | Whether the evidence supports the request and the business's risk appetite |
| Limit change | Volumes held at the current limit, override rates | Whether the higher limit is within appetite |
| Return to service | The failed run, the fix, a new certification run | Whether to accept the agent back, and at what depth |
| Incident review | The filed record of every verdict | Root cause, whether controls failed, what changes |
The risk manager does not need to run certification themselves. They need to read its output and know what a pass on each gate does and does not prove.
What should a risk manager's certificate prove?
A front-line reviewer's certificate is not enough here. A risk manager should be able to show they:
- Understand the minimum chain: every action meets role scope, certificate, sources, the business's limits and platform guardrails, and the lowest bound wins.
- Can read a certification report and challenge it, for example by asking whether the replayed cases covered the business's harder ones.
- Know that agent certificates lapse after 90 days and plan for capability dropping away if renewal fails.
- Can reconstruct a decision from the record and identify which bound should have stopped it.
- Have practised on real or realistic depth and limit requests, with their reasoning reviewed.
Risk literacy is the foundation; see what risk literacy means. The certificate builds on it with the specific mechanics of governed agents.
A depth request example
A lender's collections team asks for its agent to move from drafting payment plans to agreeing them within a limit of 1,000. The certification report shows all seven gates passed on 400 replayed cases.
The certified risk manager asks what share of those cases involved customers flagged as vulnerable. The answer is very few, because the replay set was drawn from a quiet month. They approve depth 3 for customers without a vulnerability flag, keep vulnerable customers at depth 2, and ask for a new run with a fuller set of cases before reconsidering. The approval was narrower than requested and better founded.
Which controls make risk approvals safe?
- Depth and limit changes filed with the evidence relied on, so the decision can be reviewed later.
- Two-person rule on any change that moves an agent to depth 4.
- Rights tied to a current certificate. A business can make the authority to approve depth changes depend on it.
- A practicum or supervised period before a new risk manager approves alone; how to run a two-week practicum for risk managers adapts well, with decisions captured in the practicum log template for risk managers.
For how the risk view fits with operational oversight, compare the answer for operations managers and for property managers. The guide to AI literacy and certification covers the wider programme.
Where the Academy fits
Risk managers who approve depth changes usually need more than the Operator track. Pryme Intelligence Academy's Builder track covers designing, training and certifying agents, and the Architect track is for people who lead regulated, multi-agent deployments; Certified Pryme Architect involves a capstone and a board review with two Pryme assessors, and is valid for 24 months.
Questions people ask
Should risk managers be able to approve their own team's agent changes?
No. Changes to agents the risk function uses should be approved by someone outside it, so the challenge role is not compromised.
Does certification make the risk manager accountable for agent mistakes?
They are accountable for their own approvals. A filed record showing what evidence they relied on is their best protection.
How often should a risk manager review agent depth?
At every agent recertification, after any incident, and when the business's appetite or products change.