How the scoring actually works

Every number on this site is inspectable.

Two engines run on this site — the organisational readiness assessment and the single-agent risk profiler. Both are deterministic: same answers in, same result out, every time. This page shows exactly how each one turns your answers into a score, a tier, and a set of required controls — not "trust our judgement," but the actual formula.

Risk model version 2026.1. Authored by Aseem Mohan (CISSP, CISM, CISA). Mappings current as at July 2026. Re-scoring an existing Agent Passport under a future model version is always an explicit action, never silent — an approval stays valid under the model version it was approved against.

Organisational assessment

Twelve controls, six domains, two questions each.

Scoring

Each question is scored 0-3 by the option you pick. A domain's score is the sum of its two questions (max 6). The total score is the sum of all twelve questions (max 36).

total = sum(all 12 question scores), each 0-3 domain_score = sum(that domain's 2 questions), max 6 max total = 36

Your readiness tier is a direct band on the total:

ScoreTierLabel
0-9T0Unmapped
10-18T1Documented
19-27T2Controlled
28-36T3Attested

Regulatory exposure mapping

Each of the six domains carries a mapping to five frameworks (IMDA's Model AI Governance Framework for Agentic AI, MAS AI risk management guidance, NIST AI RMF, ISO/IEC 42001, and the EU AI Act). The report shows this mapping against your weakest domain — the provisions most immediately exposed by your lowest score — rather than every provision at once, since that's the gap worth acting on first.

Status per framework is a band on your average domain score, not a legal determination:

Average domain scoreStatus
84%+MET
50-83%PARTIAL
<50%GAP

Agent risk profiler

Nine factors, each 0-3, combined with an explicit weighted formula.

The formula

Three components, each weighted differently, summed into one score out of 42:

core = ACT x INP x 2 (0-18 — action scope multiplied by untrusted input) amp = REV + DAT + TOO + DEL + RCH (0-15 — amplifying factors, summed) def = (CRD + HUM) x 1.5 (0-9 — defensive factors, weighted down) score = core + amp + def (0-42)

Why action and input are multiplied, not added: an agent that can act but only reads trusted, curated content is a different risk shape than one that can act on content it doesn't control. Multiplying reflects that the combination matters more than either factor alone — a high-action agent reading only vetted internal data scores far lower than the same agent reading the open web.

Why credentials and oversight are weighted down (1.5x, not 2x or 3x): good credential hygiene and human oversight reduce risk, but they don't eliminate the underlying exposure the way removing the action capability itself would. They're real mitigations, not full substitutes — the weighting reflects that they matter, without letting a well-vaulted credential alone pull a genuinely dangerous configuration down to a low tier.

Tier thresholds

ScoreTier
0-8CONTAINED
9-17ELEVATED
18-28HIGH
29-42CRITICAL

Control selection

Each tier has a fixed list of controls marked must (blocking) and should (recommended, not blocking). Higher tiers strictly add to the lower tier's list — nothing is ever removed going up a tier. The full list per control, with what each one actually requires, is on the control library page.

Override rules

Six conditions escalate the tier regardless of the raw score. Three are tied to a specific, cited, publicly documented incident — not a hypothetical.

Escalates to critical · Irreversible action + no pre-action approval

An agent with irreversible permissions and no human checkpoint before acting has a direct path to material, unrecoverable damage — regardless of what its raw score works out to.

Replit AI agent deletes a production database during an active code freeze

In July 2025, an AI coding agent on Replit's platform deleted a live production database — containing records for over 1,200 executives and businesses — during an explicit "code freeze" instruction. The agent later described its own action as "a catastrophic error in judgment." Replit's CEO, Amjad Masad, publicly acknowledged the incident and the company subsequently shipped automatic separation between development and production databases. The freeze existed only as a prompt instruction — nothing in the execution path actually enforced it.

Source: Widely reported, including The AI Incident Database (incident #1152), and Replit's own public acknowledgment via CEO Amjad Masad, July 2025.read more

Escalates to critical · Shared/long-lived credential + outward action channel

A shared or long-lived credential with an outward-facing action capability means one compromise doesn't stay contained to one agent — it reaches everything that credential can touch.

Salesloft Drift breach — stolen OAuth tokens reach 700+ organisations

Between 9-18 August 2025, a threat actor tracked as UNC6395 exploited stolen OAuth tokens from Salesloft's Drift AI chat integration to access Salesforce, Google Workspace, and other connected environments across more than 700 organisations, including several major technology companies. The tokens were long-lived and not scoped per-integration, so one compromised credential source cascaded across every organisation using the integration.

Source: Google Threat Intelligence Group / Mandiant investigation; reported by The Hacker News and confirmed via FINRA industry guidance, August-September 2025.read more

Escalates to critical · Publicly reachable + outward action capability

If anyone on the internet can supply an agent's instructions, and that agent can act outward, there is no boundary left to reason about.

Escalates to critical · Can be invoked by agents outside your control

Attribution to a human principal cannot be maintained once an agent can be triggered by something you don't govern.

Escalates to high · Elevated action capability + untrusted input + outward channel

This specific combination — privilege, content it doesn't control, and a way to act on the outside world — is the pattern behind most documented agent and MCP compromises.

Escalates to high · Tools acquired from public marketplaces

A tool with a clean track record can turn malicious in a later update, and most organisations have no process to catch that.

postmark-mcp — a trusted npm package turns malicious after 15 clean releases

A package called "postmark-mcp," impersonating the email provider Postmark, was downloaded roughly 1,500 times a week and used inside AI agent tool chains to send email. Version 1.0.16, published 17 September 2025, added a single line of code that silently copied every outgoing email to an external address — invoices, password resets, internal correspondence. Postmark itself had never published this package; it was an unauthorised copy that built trust over fifteen earlier, genuinely clean versions before the backdoor was added.

Source: Discovered and disclosed by Koi Security; confirmed by Postmark's own security statement and reported by The Hacker News, September-October 2025.read more

What this isn't

Nine or twelve questions cannot capture a real architecture. Both tools are triage — they tell you what to examine properly and which controls to require, not that an agent or an organisation is safe. Framework mappings are indicative, current as at July 2026, and are not a compliance determination or legal advice. Confirm against current text for your jurisdiction and sector before relying on this for an audit or regulatory submission.

Risk model version 2026.1. Last reviewed July 2026.

© 2026 Aseem Mohan · Assessment · Control library · Privacy notice