AgentRiskBOM: A Risk-Scoping Security Bill of Materials for Agentic AI Systems

Abstract: Agentic AI systems retrieve private context, invoke tools, write files, call external services, coordinate with other agents, and may act without human approval. Existing bill of materials artifacts improve transparency for dependencies, model metadata, and training provenance, but leave an agentic transparency gap: capability opacity, the absence of a structured account of what a deployed agent can access, remember, change, delegate, and prove afterward. This paper introduces AgentRiskBOM, a security BOM for risk-scoping tool-using AI agents. It is an additive layer over SBOM, AIBOM, and MLBOM artifacts, referencing them where authoritative while adding fields for runtime authority: autonomy, tool permissions, memory, credential scope, approval gates, audit signals, inter-agent communication, and external action capability. We implement AgentRiskBOM as a JSON-schema artifact with a reproducible corpus, risk scenarios, scorer, diff detector, control mapper, and reports. We evaluate AgentRiskBOM on 13 open-source agents spanning coding, RAG, and multi-agent archetypes, plus 52 risk scenarios across 14 categories. The schema validates all 13 corpus artifacts. Coverage analysis gives AgentRiskBOM a native-equivalent score of 14 across 16 capability dimensions, vs. 1 for SBOM, 1.5 for AIBOM and 2 for MLBOM. Across modeled risk categories, AgentRiskBOM exposes 100% risk-category visibility vs. 10.5% for SBOM-like and 20.9% for AIBOM-like views. To test agentic authority drift, we inject 33 structured deployment mutations; the diff detector identifies the correct change type for all mutations. A secondary penalty-based scorer yields a Spearman correlation of 0.73 with the primary scorer, supporting rank-level consistency while showing that thresholds require human calibration. The results show that agentic AI security needs a machine-readable authority-and-risk artifact before incidents occur.

• The paper introduces AgentRiskBOM, a novel schema that maps agent authority to address transparency gaps in autonomous AI systems.
• The evaluation demonstrates that AgentRiskBOM achieves 100% risk category visibility and higher risk scores compared to traditional BOM methods.
• The framework enables mechanical review, drift detection, and forensic readiness by formalizing permissions, tool access, and audit controls.

AgentRiskBOM: A Security Bill of Materials for Agentic AI Systems

Motivation and Problem Statement

As agentic AI systems transition from passive endpoints to autonomous actors capable of context retrieval, tool invocation, file operations, external communication, and inter-agent coordination, existing transparency artifacts such as SBOM, AI-BOM, and ML-BOM fail to capture the operational authority and runtime risk surface inherent to these agents. The opacity in what an AI agent is allowed to do—its delegated, actionable capabilities—constitutes a structural transparency gap. While prior bills of materials enumerate dependencies, model provenance, and dataset origins, they do not describe agentic authority, including tool-access tiers, memory persistence, credential scope, approval gates, audit logging, and inter-agent trust propagation. This deficiency is pronounced given practical threat vectors such as indirect prompt injection, tool poisoning, unsafe external actions, and memory leakage, each of which exploit the agent's runtime configuration rather than static code or model artifacts.

AgentRiskBOM Design and Core Schema

AgentRiskBOM is introduced as an additive, schema-first security artifact, mapping the authority envelope of tool-using agents onto a formal representation. The schema delineates distinct layers: agent identity, model and prompt metadata, tool descriptors and permissions, memory/data retention and provenance, orchestration boundaries, autonomy and approval gates, inter-agent delegation, audit logging, and provenance metadata. Optional fields are supported, enabling schema adaptability across coding assistants, RAG agents, and multi-agent ensembles without overfitting non-applicable components.

Figure 1: Schema expressiveness across corpus archetypes. Mean per-layer completeness exceeds 75\% for every archetype, validating schema adaptability.

The schema's alignment with operational threats is illustrated through concrete review questions: actions executable without human approval, reachability to external systems, memory and data exposure, deployment change detection, incident reconstructability, and requisite controls. Each field group is tightly scoped to support mechanical review, versioned diffing, risk scoring, and control mapping.

Evaluation: Coverage and Risk Visibility

The evaluation leverages a corpus of 13 open-source agents spanning coding, RAG, and multi-agent systems, together with 52 risk scenarios across 14 dimensions. AgentRiskBOM achieves a native-equivalent coverage of 14 out of 16 relevant agentic dimensions, compared with SBOM (1.0), AI-BOM (1.5), and ML-BOM (2.0). Notably, tool descriptors, runtime autonomy, approval gates, credential scope, audit signals, authority diffing, and forensic readiness are only natively represented within AgentRiskBOM.

Using risk-scenario coverage, AgentRiskBOM exposes 100.0% of modeled agentic risk categories, sharply contrasting with SBOM-like (10.5%) and AI-BOM-like (20.9%) artifacts. Visibility gaps in prior artifacts pertain to excessive agency, unsafe external actions, inter-agent trust, approval and audit deficiencies, overprivileged cloud access, destructive tool misuse, credential misuse, and memory leakage.

Figure 2: Agentic risk-category visibility across applicable corpus risks, quantifying superiority of AgentRiskBOM views for security assessment.

Figure 3: Agentic risk surface over autonomy level, maximum tool-risk tier, and data sensitivity. High-risk quadrant includes seven of 13 corpus agents.

The risk-surface plot reveals that over half the corpus agents inhabit the high-risk quadrant (autonomy ≥ A3, tool-risk tier ≥ T4), demanding priority for deployment review, approval requirement, and log retention. The mean risk score is 53.5/100, with AutoGPT marking the highest observed score, corroborated by pronounced autonomy and tool-access scope.

Authority Drift and Deployment Dynamics

AgentRiskBOM operationalizes deployment-risk management via structured authority drift detection. A total of 33 targeted schema mutations (tool addition, permission escalation, autonomy increases, memory persistence expansions, and control removals) were injected across the corpus, and the diff detector achieved perfect recall and correct change-type assignment. This result illustrates that, once agent authority is formalized via typed schema fields, configuration changes relevant to security are reviewable and diffable pre-deployment.

Controls, Auditability, and Forensic Readiness

Risk-driver mapping to control families is rule-based: high autonomy and tool access necessitate least-privilege enforcement, human approval, tamper-resistant logging, and emergency stops. Persistent memory over sensitive data is mapped to retention limits and access controls, while external communication mandates approval gating. Corpus-wide, auditability is suboptimal, especially for RAG agents, with scores driven by signal log presence, tamper resistance, retention, prompt-change control, tool descriptor hashes, and provenance metadata.

Figure 4: Forensic readiness by archetype, quantifying auditability through composite logging and provenance signals.

Scoring Consistency and Calibration

Primary and secondary penalty-based risk scores exhibit a Spearman rank correlation of 0.73, indicating directional robustness but imperfect categorical threshold calibration. This underscores the triage utility of scoring while highlighting the necessity for human expert review and deployment-context calibration, rather than automated certification.

Figure 5: Primary score compared with an independent penalty-based scorer, evidencing directional ranking consistency.

Agentic Authority Drift and Trust Network Visualization

The artifact-centric review paradigm is reinforced by the explicit representation of agentic authority drift—changes in runtime-permitted actions independent of the underlying model or software dependencies. Authority drift vectors (tool registry, credential propagation, memory retention, approval gate removal) are difficult to govern within conventional BOMs; AgentRiskBOM achieves mechanical reviewability through versioned artifacts. The deployment-level implicit trust structure among agents, tools, external systems, audit log, and human approval is directly visualized for the highest-risk agent.

Figure 6: Tool-permission network for AutoGPT, highlighting implicit trust structure and operational exposure.

Implications and Future Directions

AgentRiskBOM foregrounds delegated authority as a first-class object of review, enabling mechanical triage, deployment gating, drift detection, forensic assessment, and control mapping. Its additive design permits profile-based standardization alongside SBOM, AI-BOM, and ML-BOM, minimizing adoption friction and fostering extensibility for agent identity, tool descriptors, memory stores, and audit evidence.

Practically, AgentRiskBOM is positioned for deployment review, procurement policy, CI/CD change detection, and incident response baseline establishment. Theoretically, it addresses capability opacity inherent in agentic AI, advancing agent transparency from component inventory toward structured operational authority review. Future AI development will demand rigorous formalization of agent authority envelopes as tool invocation, memory persistence, cross-agent delegation, and external action capabilities become ubiquitous.

Standardization trajectories include integration into software supply-chain attestation systems, agent profile extension namespaces, and adoption as a prerequisite for operational agent deployment in regulated environments. Enhanced scoring calibration, expanded control mapping, and incorporation of runtime evidence streams will further strengthen AgentRiskBOM's utility.

Conclusion

AgentRiskBOM establishes a structured, machine-readable substrate for risk-scoping in agentic AI systems, targeting the decisive security boundary: what the deployed agent is allowed to do. The approach supports schema expressiveness across archetypes, comprehensive risk visibility, deployment-level authority drift detection, control mapping, and forensic readiness assessment. With AI systems increasingly functioning as actors rather than predictors, AgentRiskBOM offers the necessary transparency for governing agent authority before runtime incidents occur.