How to onboard a new risk manager to an AI agent workspace

A new risk manager needs two weeks to become useful in a workspace where agents already act. Week one: build their own map of every agent, capability, depth and certificate, and reconstruct real decisions from the record. Week two: test the controls against the firm's risk appetite and take over one sign-off, with the outgoing owner checking their work.

What is the risk manager's part, and who runs the onboarding?

Operators review the agents' held items one by one. The risk manager looks across them. Their questions are different: is any agent acting deeper than the evidence supports, do the customer's own limits match the risk appetite the board approved, and could the firm explain any single decision to a supervisor tomorrow?

The head of risk owns the onboarding. The day-to-day guide is usually the operations lead who runs the workspace, because the newcomer needs to see how things work in practice before judging whether they work. If your firm has an AI operations function, its role is set out in what an AI operations manager does.

How should the first two weeks run?

1. Day 1. Person (head of risk): grants read access to the workspace and the record. No change rights. The agents carry on at their certified depths.
2. Days 1 to 3. Person (newcomer): builds an inventory from the workspace, not from a slide. For each agent: its capabilities, the depth of each, the date each certificate was issued and lapses, and the ceiling set by the plan. Depth is earned, not configured: the role sets a ceiling, evidence from Attest sets the depth, and the lower wins. Any gap between what the newcomer was told and what the workspace shows is their first finding.
3. Days 3 and 4. Agent, depth 2 to 4: keeps acting; the newcomer reconstructs five decisions from the record. Pick one allowed, one held, one refused, one withheld and one decided by a person after a hold. For each, name the five bounds in the minimum chain (role scope, certificate, sources, the firm's own limits, platform guardrails) and say which one decided.
4. Day 5. Person (newcomer and operations lead): read the last Attest results. Seven gates must each clear on their own: grounded, refuses, depth, escalates, scope, adversarial, stable. A narrow pass on the escalation gate tells a risk manager more than a comfortable overall picture.
5. Days 6 to 8. Person (newcomer): compares the firm's own limits with the risk appetite statement. If appetite says no single unsecured exposure above 50,000 without a second approver, the limit on the agent should hold anything above that. Where the two disagree, the newcomer writes it up.
6. Day 9. Person (newcomer): walks the incident path. Who can tighten an agent's limits so everything is held, who is told, how the record is preserved. Agent certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day, so the newcomer should know which processes would stall and who covers them.
7. Day 10. Person (head of risk): signs off the newcomer's inventory and findings, then hands over one recurring review, such as the monthly report on held and refused actions.

The plan at a glance

What evidence should each control leave?

A risk manager trusts what leaves a trace. Four traces matter in the first fortnight.

The inventory itself, dated and signed by the head of risk. It becomes the baseline for the next quarter's review.

Reconstructed decisions. Every verdict is filed in an append-only record, so each reconstruction can be checked by someone else. If two people reach different answers from the same record, the record is not the problem; the training is.

Written limit findings. A note that the firm's own limits sit above risk appetite in one capability, with a proposed fix and an owner.

A dry run of narrowing. In a test or a quiet period, the newcomer watches the operations lead tighten one agent's limits so that every action is held, then restore them. The record shows both changes, with names.

How do you know the newcomer is ready?

Look for three things. They can explain any verdict without help. They can say, for each process, what happens on the day an agent's certificate lapses. And their limit findings are specific enough that someone could act on them.

Avoid measuring how much of the workspace they have "covered". A risk manager who has read everything but cannot reconstruct one held decision is not ready.

Where does risk onboarding go wrong?

Starting from policy instead of the workspace. Newcomers often read the AI policy, the risk register and the board papers first. They then audit the agents against documents that may already be out of date. Start with what the workspace shows and compare.

Confusing refused and withheld. A refused action is outside this agent's bounds, often the firm's own limits. A withheld action is refused on purpose at the platform floor for every agent at every depth. A risk manager who asks the operations team to "unwithhold" something has misunderstood the control.

Owning everything at once. Hand over one review, not the whole function. The same staged approach works for other roles; compare onboarding a new operations manager and, for a frontline role, onboarding a new property manager. A structured version is in the AI agent training plan template for risk managers, and the full picture of who to train and how is in training teams for AI agents.

Where the Academy fits

A risk manager does not run the queue, so the Operator track is optional. The Foundations track covers the decision chain, depth and certification, and ownership, data and trust in about four hours. For a risk lead who will oversee regulated deployments with several agents, the Architect track goes further, ending in a board review with two Pryme assessors and a certificate valid for 24 months.