The frameworks you already use weren't built for this
Hi John,
Most security and compliance programs lean on frameworks like the NIST AI RMF, ISO 42001, or the EU AI Act to reason about AI risk. Good frameworks, written before autonomous agents were a mainstream reality.
(If NIST AI RMF, ISO 42001, and the EU AI Act are blurring together, our glossary is a quick way to keep the terms straight.)
Here's the gap: those frameworks were built to answer whether a system is authorized. Agents raise a harder question: what did it actually do, and was that appropriate? Those aren't the same thing, and the difference is where the risk lives.
We put together a checklist to help you see where the gaps might be in your own environment.
Frameworks like these keep shifting as agents change what "risk" means. Zenity's blog is where we track that as it happens, if you want to follow along.
The Zenity Team
Zenity Inc, 600 5th Avenue, Suite 1600, New York, New York 10020, United States