TLDR Tech / InfoSec
Zero Risk Isn't the Job: a CISO's Guide to Agentic AI
This post outlines how Anthropic assesses risk for internal agentic workloads. To understand the risk associated with an agent, Anthropic asks what untrusted content an agent will ingest, what actions the agent can take, what the blast radius is in the case of misalignment, and what observability is available. Anthropic also defines an identity access model spectrum where agents may run as a self-contained, single-purpose, least-privilege identity that does one thing for the business with no human identity on one end and human credential agents where employees use an agent such as a chatbot or Claude Cowork directly on the other end.
Read the full story