Risk appetite for AI agents should be written in actions

"Low appetite for AI risk" cannot be checked at the moment of action. "Agents may draft refunds of any size but issue none above 500 without a named approver" can. Write appetite as actions, each with a depth and the limit above which a person decides, and software can enforce it.

Why do adjective-based appetite statements fail for agents?

Most risk appetite statements were written for boards and senior managers who interpret them. "Low appetite for conduct risk" works because a person reading it can apply judgement to a specific decision. They know roughly what low means in their context, they can ask, and they answer for the choice.

An agent cannot interpret "low". It will act on whatever bounds it has been given. If the appetite statement says low and the agent's configuration allows refunds of any size, the configuration wins every time. The appetite statement sits in a document; the agent sits in production. Nothing connects them except the hope that whoever configured the agent read the document and translated it faithfully.

That translation is where appetite quietly gets lost. Different teams read "moderate" differently. A team under pressure to hit an automation target reads it generously. Nobody records the translation, so nobody can check it.

What does appetite written in actions look like?

It names the actions agents may take, sets a depth for each, and states the limit or condition at which authority passes to a person. Depth here means how far an agent may act: read, draft for a person to send, execute routine work within limits, or move money and take actions that are hard to undo.

Each cell can be checked. An agent proposing a refund of 600 can be held for a named person. An agent proposing to send a complaint response can be stopped at draft. An auditor can test whether the check worked. A risk appetite statement template for AI agents lays this out in a form a board can approve.

Where do the qualitative statements still belong?

At the top, as the reason for the rows below. A board that says "we have low appetite for customer harm from automated decisions" is making a real choice, and it should. The action table is how that choice is expressed in terms an agent will meet. Each row should trace back to a qualitative statement, so a reviewer can see why the refund limit is 500 and not 5,000.

The error is stopping at the qualitative layer. Appetite statements that never reach actions are guidance for people, which is valuable, but they do not govern agents. Our argument that written AI policies do not bind agents makes the same point about policy more broadly.

How do you decide what goes in the never-permitted column?

Start with actions whose harm cannot be undone or cannot be justified at any volume. Reversing a settled payment, disclosing one customer's data to another, acting on an instruction found inside a document the agent was asked to read. These belong at the floor for every agent, regardless of depth or certification. Our guide to deciding which actions no AI agent may take sets out a method.

Keep this list short. If it grows long, it usually means the organisation is using "never" where it means "not yet" or "not without a person". Those belong in the condition column, where they can be widened later on evidence. Actions that are truly never permitted should be recorded in one place with the reason, using something like a withheld actions register, so nobody has to rediscover why.

Who decides when an action crosses the line?

Every condition in the table needs a named role behind it. If refunds above 500 are held, someone must be named as the approver, with the time and information to decide. If that person is not defined, the appetite statement has created a queue with no one to clear it. Our piece on who approves an AI agent's held actions works through how to assign that role.

The approver role is also where appetite gets tested in practice. If approvers clear held refunds at 600, 700 and 900 without hesitation, the appetite may be set below where the business is actually comfortable. If they refuse many, it may be about right. Either way, the record of approvals tells the board whether its stated appetite matches its behaviour.

How often should action-based appetite be reviewed?

More often than a traditional statement, because agents change faster than the business does. New capabilities get added, depth is widened on evidence, customer limits shift. A sensible cadence is a full board review annually with a committee review each quarter, focused on changes: actions added, limits raised, conditions removed, and any action that moved from never permitted to permitted.

Review should rely on the verdict record, not on assertion. How often did each limit hold an action? How many were refused at the floor? Were any limits raised without a matching change in appetite? Those numbers show whether the appetite is being honoured or worked around.

What is the trade-off?

Writing appetite in actions is more work and less flexible. It forces the board and management to commit to specific limits that may turn out to be wrong, and to revisit them. Adjectives are easier to agree because they postpone the disagreement.

Postponing it does not remove it. It moves the decision from the board to whoever configures the agent, usually a technical team with no mandate to make it. Writing appetite as actions puts the decision back where it belongs, makes it enforceable, and leaves a record showing it was enforced. Take your current AI appetite statement and, for each sentence, write the actions it implies and the limit at which a person decides. Any sentence you cannot translate is not yet governing your agents. The framework that makes these limits enforceable is in our guide to agent governance as a bound, not a model.