Turning risk appetite into depth and limits is the risk manager's most decisive skill when agents act, because those settings decide what can go wrong before anything does. Next, in order: reading certification evidence, tracing which bound decided a verdict, choosing indicators that show drift early, mapping agents into model risk practice, and planning for certificate lapse.
What does a risk manager oversee when agents act?
Risk managers set appetite, design controls, monitor indicators, investigate incidents and report to committees and supervisors. An agent that acts is a new source of operational, conduct and model risk. But a governed agent also produces evidence: certification results, verdicts with their deciding bound, and an append-only record.
The risk manager's skill is turning appetite into bounds and evidence into assurance.
Which skills matter most, ranked?
- Expressing appetite as depth and limits. Depth runs from 1 (read) to 4 (move money or take hard-to-undo actions) and 5 (coordinate other agents). The customer's own limits narrow what an agent may do within its depth. A risk manager should be able to write appetite statements that map directly to these settings, capability by capability.
- Reading certification evidence. Attest replays an agent against real cases from the business's own operation and scores each answer against a floor across seven gates: grounded, refuses, depth, escalates, scope, adversarial and stable. Each must clear on its own. A risk manager should read which gates were close.
- Tracing the deciding bound. Every verdict names the bound that decided it. If refusals cluster at platform guardrails, the business's own limits may be missing. If allowed actions sit just under a limit, the limit may be wrong.
- Choosing early indicators. Hold rate, override rate, refusals by reason and time to approve held items show drift before losses do.
- Fitting agents into model risk practice. Model risk is supervised in most banking markets. Risk managers should know how certification evidence fits the firm's existing model risk framework and where agents differ from models.
- Planning for lapse. Certificates lapse after 90 days, and a run that clears no depth drops an agent to depth 1 the same day. The business must be able to absorb that.
What does each signal tell the risk manager?
| Signal | What it may mean | Who acts |
|---|---|---|
| Override rate rising | Agent drifting or reviewers stricter | Owner and builder |
| Held items ageing | Review capacity short | Operations manager |
| Refusals at role scope | Misrouted work or scope too narrow | Owner |
| Near-miss on a gate at renewal | Margin thinning | Builder, before next run |
What does appetite-as-depth look like in a case?
Take an insurer's risk team preparing for a claims agent. The board's appetite says no single automated payment above 5,000 and no automated declines. The risk manager writes that down as settings: claims payment certified at depth 4 with the customer's own limit at 5,000, two-person approval above 20,000, and the decline capability kept at depth 2 so every decline is drafted for a person.
Three months later the record shows 40 declines drafted and every one reviewed, payments above 5,000 all held, and one renewal where the escalation gate cleared with little margin. The risk report to the board uses the record, not a narrative.
Operations and property managers see the same signals operationally; see skills for operations managers and skills for property managers. Routine work done alone needs its own indicators; see the skills that matter when agents act alone.
How should risk teams build these skills?
Write appetite statements for one agent as depth and limit settings, then test them against last quarter's cases. Read one Attest report end to end with the builder. For market detail, see risk manager training in insurance in Ireland and in Nigeria. The role map is in AI agent skills by role.
Where the Academy fits
Risk managers who lead regulated or multi-agent deployments fit the Architect track at Pryme Intelligence Academy: about 30 hours plus a capstone and a board review with two Pryme assessors. It earns Certified Pryme Architect, valid for 24 months. Those overseeing a single agent often start with Foundations and Operator.
Questions people ask
Should risk managers approve agent depth?
They should approve the appetite that limits it. Depth itself is earned through certification evidence within the role's ceiling; the lower of the two wins.
Is an agent a model for model risk purposes?
It often uses models and should be governed with similar discipline. But an agent also acts, so its bounds, approvals and record matter as much as its accuracy.
What should go to the board?
Agents by capability and depth, certificate status, the indicators above and any incidents. The record lets the board see evidence rather than assurances.