ACRS
Score agentic capability risk before deeper control assessment.
The Agentic Capability Risk Score helps teams triage AI agents and workflows by asking how dependent the business is, what the agent can do, what it can access and how much harm a failure could cause.
Discuss ACRS triageThe four scoring dimensions
Operational dependency
How hard would it be to operate safely if this system failed, was paused or was withdrawn?
Action autonomy
How much can the AI decide or do before a human approves the next step?
Access scope
Which data, tools, identities, repositories, APIs and business systems can the workflow reach?
Harm potential
How serious could the consequences be if the system failed, was misused or was compromised?
How Gamut uses ACRS
Fast intake
Use ACRS early to route systems into the right level of governance and review.
Risk tiering
Translate the composite score into a clear risk band for prioritization.
Control routing
Use the score to guide GTSAF and ATF controls, evidence requests and approval expectations.
Review outputs
- Agentic workflow risk band.
- Explanation of dependency, autonomy, access and harm drivers.
- Recommended governance route and control depth.
- Evidence request and remediation starter set.