Risk Dashboard
The Risk & Compliance Dashboard scores every active agent from what its traces show: how often guardrail detections fire, how often it uses unapproved models, and how often it fails. It places each agent on a likelihood by impact heatmap, breaks its risk into four dimensions, and shows its open drift alerts and framework compliance status.
Enterprise feature. Open it from Governance → Risk Dashboard. It needs the Risk Dashboard permission at Read, which Owner, Security & Compliance, Department Admin and Auditor have. See Members & Roles.
Which agents are scored
Every agent that sent at least one trace with an agent ID in the selected time range is scored, whether or not it has a governance profile. Scores use these signals for the time range:
| Signal | Source |
|---|---|
| Requests | Number of the agent's traces |
| Detections | Traces flagged for PII, PCI, PHI, Ethics & Bias or jailbreak by Scheduled Detection |
| Compliance violations | Uses of a model that is not approved in the AI Inventory |
| Error rate | Failed requests as a share of all requests |
| P95 latency | The agent's 95th percentile latency |
| Governance | Evidence coverage, open drift alerts and detection policy status from the agent's governance profile |
Each rate is a count divided by the agent's requests, capped at 100%. An agent whose traces have not been scanned by Scheduled Detection has no detections, so its risk can look lower than it is.
Summary cards
| Card | Meaning |
|---|---|
| High-Risk Agents | Agents at Critical or High risk level |
| Medium-Risk Agents | Agents at Medium risk level |
| Low-Risk Agents | Agents at Low risk level |
| Active Drift Alerts | Unresolved drift alerts across all agents, with a daily trend |
| Compliance Coverage | Average evidence coverage across agents that have a governance profile |
Filters
- Time range: Last 24 hours, Last 2 days, Last 3 days or Last 7 days (default). Seven days is the maximum.
- Framework: All Frameworks, EU AI Act, NIST AI RMF, ISO 42001, SOC 2 or ISO 27001. Choosing a framework keeps the agents whose profile tracks it, plus agents with no profile.
View Drift Alerts opens the full Drift Alerts list.
How risk is computed
Each agent gets two scores from 0 to 100.
Likelihood = 40 x detection rate + 35 x compliance violation rate + 25 x error rate
Business impact = 35 x PII and PHI rate + 25 x PCI rate + 20 x jailbreak rate + 15 x ethics and bias rate + 5 x error rate
The risk level comes from both scores:
| Level | Rule |
|---|---|
| Critical | Likelihood at least 75 and impact at least 75 |
| High | Likelihood at least 50, or impact at least 60, or likelihood at least 40 with impact at least 50 |
| Medium | Likelihood at least 20, or impact at least 25 |
| Low | Everything else |
AI Risk Heatmap
The AI Risk Heatmap plots each agent by Likelihood of Drift (columns 0-25%, 26-50%, 51-75%, 76-100%) against Business Impact (rows Low, Medium, High, Critical, from impact scores up to 25, 50, 75 and above 75). The top-right cells are the agents to look at first. Select an agent to open its detail panel.
Active drift alerts
Below the heatmap, Active Drift Alerts lists open drift alerts across all agents. From an alert you can view its traces, open the agent's governance profile, open the agent's risk detail, or send it to ServiceNow or PagerDuty. See Drift Alerts.
Agent detail
Selecting an agent opens a panel with its risk level, a time range selector, requests, error rate and when its governance profile was last updated. The same view is available as a full page, Agent Risk Detail.
Risk dimensions
The diamond chart scores four dimensions from 0 to 100. Higher means more risk.
| Dimension | How it is scored |
|---|---|
| Compliance | 40 x evidence coverage gap (an agent with no profile counts as a 50% gap) + 40 x compliance violation rate, plus 4 points if the agent's detection policy is disabled, 3 if it has none, or 2 if no detector has run in the last 24 hours |
| Security & Privacy | 70 x PII, PCI and PHI rate + 30 x jailbreak rate |
| Model Risk | 30 x ethics and bias rate + 25 x jailbreak rate + 25 x open drift alerts (full weight at 10 alerts). The remaining 20 points are reserved for stored runtime metric drift, which is not recorded today, so Model Risk currently reaches at most 80. |
| Operational | 60 x error rate + 40 x P95 latency against a 5 second limit (full weight at 5 seconds or more) |
AI Violations
A daily chart of the agent's detections by category (PII, PCI, PHI, Ethics/Bias, Jailbreak) over the time range, with a link to the matching traces in AI Violations.
Compliance Status
One card per framework the agent's profile tracks:
| Status | Meaning |
|---|---|
| Completed | Every requirement's evidence is filled and attested |
| Awaiting Sign-off | All evidence is filled, but some categories still need attestation |
| Partial | Some requirements still need evidence |
| Not Assessed | No progress, or the agent has no governance profile |
See Framework Coverage for how requirements are assessed.
Drift
The agent's open drift alerts. Drift is recalculated for every agent by a background job, so this section shows the latest stored alerts. See Drift Alerts.
Typical workflow
Read the posture
Start with the summary cards and the heatmap. Agents in the top-right cells have high likelihood and high impact.
Diagnose an agent
Select the agent. The dimension chart shows what drives its risk: data exposure, model behavior, compliance gaps or reliability.
Act on the cause
Review detections in AI Violations, approve or replace models in the AI Inventory, complete evidence in Evidence Collection, or resolve drift alerts.
Next steps
- AI Agent Center: the operational view of the same agents.
- PII Detection: turn on the detections that feed risk scores.
- Framework Coverage: close compliance gaps.