Risk managers need a different lesson from front-line reviewers. They must recognise injection in the record after the fact, design tests that find it before go-live, and resist the pressure aimed at them: requests to raise an agent's depth early, to downgrade an incident, or to accept an external data feed without checking it. Train all three with real cases.
What is the risk manager's part in this?
Front-line reviewers decide individual held items. Risk managers own the view across them. They set the risk appetite for each agent, review incidents, challenge the evidence behind certification and report to committees. Prompt injection matters to them in three ways.
First, as a pattern. A single planted instruction in a supplier invoice is a front-line catch; twenty in a month across different teams is a campaign. Second, as a test. OWASP's Top 10 for LLM Applications lists prompt injection and excessive agency among the main risks, and the risk function should make sure both are tested. Third, as pressure on the risk manager personally, which is the part most programmes leave out.
The chief risk officer owns the programme. The security team and the builders who shape agents contribute cases.
What pressure do risk managers face?
- Raise the depth now. A business owner wants an agent moved from drafting to executing before the evidence supports it. Depth is earned, not configured: the role sets a ceiling, evidence from Attest sets the depth, and the lower wins. Risk should not be the party that bends this.
- Downgrade the incident. A manipulated action is described as a "data quality issue" to keep it off a committee report.
- Accept the feed. A new external source, such as a market data service or a public register, is added to an agent's sources without assessing how its content could steer the agent.
- Approve an exception by email. A senior name asks for a one-off release of something the agent refused.
The steps
- Person (chief risk officer): sets the red lines for risk staff. For example: no support for a depth increase without passed certification evidence; no incident reclassified without the record being reviewed; no new external source approved without a test of injected content.
- Person (trainer): assembles a case pack from anonymised incidents, near misses and red-team findings, with planted injection in some agent records and pressure scenarios in some emails and meeting notes.
- Agent, depth 1: retrieves the decision records for each case, showing verdicts, the deciding bound and the provenance of every fact.
- Person (risk manager): reads each record and states whether manipulation was attempted, whether it succeeded, and which control stopped it or failed.
- Person (risk manager): drafts a test for one weakness found, using the prompt injection test plan.
- Person (trainer): runs a committee role-play in which a business sponsor argues for an early depth increase.
- Person (chief risk officer): debriefs each analysis and each role-play.
- Agent, depth 1: logs the exercise and its outcomes.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Incident review | Retrieves the full decision record | 1 | Risk manager judges what happened |
| Pattern detection | Lists flagged instructions across teams | 1 | Risk manager decides whether it is a campaign |
| New external source | Stamps its content external | 1 | Risk manager approves only after testing |
| Depth increase request | Shows certification evidence and gaps | 1 | Risk committee decides |
| Exception to a refusal | Refuses at the bound that decided | refused | Owners of the limits decide any change |
How do you read a record for manipulation?
Teach a fixed sequence. Start with the verdict and the bound that decided it. Then look at the facts the agent relied on and their provenance: sealed, signed, declared or external. Then look for text in the inputs addressed to the agent. Finally, look at what the person did with the result.
Take a hypothetical case. An agent drafted a credit limit increase for a business customer. The record shows the deciding fact, annual turnover, came from a declared figure in the customer's message rather than signed accounts, and the message contained a sentence instructing the assistant to "use the turnover stated here". The agent held the increase; a reviewer approved it within two minutes. The control that failed was the person, and the risk response is training and approval rights, not a new rule for the agent.
Which controls matter, and what evidence do they leave?
- Certification evidence for depth. Evidence: Attest results per capability, and the committee minute.
- Source approval with injection testing. Evidence: the test plan, results and approval.
- Incident classification review. Evidence: the record reviewed and who classified it.
- Cross-team pattern reporting. Evidence: the monthly summary of flagged instructions.
- Exercise records. Evidence: case pack, analyses and debrief notes.
What should you measure?
Cases where the risk manager correctly identified the failed or successful control. Tests written and run from findings. Depth requests supported only with passed evidence. Incidents reclassified, with the reasons. And time from the first flagged instruction in a pattern to a risk alert.
Where does it usually go wrong?
Risk staff are trained only on frameworks. NIST AI RMF and ISO/IEC 42001 are useful structures, but they do not teach someone to read a record.
Pressure training is skipped as awkward. The committee role-play is often the most valuable hour in the programme.
Risk reviews only incidents, never near misses. Most manipulation is caught at the front line, and those catches are where the patterns show.
A practical template for the testing side is the prompt injection test plan template, and a short primer is what prompt injection is. Front-line counterparts are covered in training operations managers on injection and pressure. Build the programme with the AI agent training plan template for risk managers, within the guide to training teams for AI agents.
Questions people ask
Should risk managers be certified to the same level as reviewers?
They need at least what reviewers know, and usually more about how agents are built and certified. In regulated, multi-agent deployments, the depth of training should match the scope of their oversight.
Who decides whether an external source is safe to add?
The agent's owner proposes it; risk challenges it and approves only after testing. The decision and the test results belong in the record.
Is a successful injection always an incident?
If it changed an action or a disclosure, yes. If a control stopped it, record it as a near miss and use it in training.