UC Berkeley Agentic AI Risk Management Profile: Autonomy, Containment, and Control (2026)

Why UC Berkeley Built a Separate Agentic Profile

UC Berkeley's Center for Long-Term Cybersecurity (CLTC) launched the Agentic AI Risk-Management Standards Profile in February 2026. Version 1.0 is authored by Nada Madkour, Jessica Newman, Deepika Raman, Krystal Jackson, Evan R. Murphy and Charlotte Yuan. It complements NIST AI RMF and Berkeley's General-Purpose AI Profile, with guidance for developers and deployers of agentic systems.

An agent deployment needs a system-level review of authority, tools, memory, environment and interactions with other agents. Assess what the configured system can do, how its actions affect people and systems, and which controls constrain those actions.

The profile discusses bounded autonomy and layered containment. The implementation examples below are Move78 adaptations for review; they are not verbatim publisher checklists or a guarantee that a given control prevents harm.

The profile is a 67-page research document, not a regulation or a certification standard. Use it to identify risk-management questions and review evidence in the deployment context. Its publication does not establish government endorsement of this page's recommendations.

The Autonomy Spectrum (L0–L5)

The profile's Map 5.1 guidance includes an autonomy scale adapted from Kasirzadeh and Gabriel (2025). The summaries below paraphrase that example. Autonomy is one review dimension alongside authority, causal impact and environment; the suggested governance actions are Move78 recommendations.

Move78 recommendation: review the combination of autonomy, access and consequences before choosing oversight or containment. A level label alone does not demonstrate that user oversight is sufficient or that the system is safe to deploy.

Move78 recommendation: reassess the agent when tool permissions, API credentials or connected data change. Compare its actual authority with the documented task and approval boundaries; do not infer an autonomy level from a credential alone.

Bounded Autonomy Design

Move78 implementation example: specify operational boundaries for tools, data, financial authority, duration and decision scope. These five illustrative categories are a design aid, not a five-part taxonomy mandated by the Berkeley profile. Choose enforcement and escalation appropriate to the system and test whether attempted boundary violations are contained.

Five Boundary Types

• Tool/API Boundary: Whitelist of authorized tools and APIs. The agent can only invoke what's explicitly listed. Any out-of-bounds invocation is blocked - not flagged for review, blocked. Enforcement at the API gateway level, not application level.
• Data Access Boundary: Scoped read/write permissions at the database and API level. The agent can read the FAQ database but can't read customer PII. Enforced via database-level permissions, not application logic that the agent could bypass.
• Financial Boundary: Monetary caps per transaction and per time period. An agent authorized to process refunds up to $100 can't approve a $500 refund regardless of context. Validation occurs before execution, not after.
• Temporal Boundary: Duration limits before mandatory human review. An agent running a data migration can't operate for 12 hours without a human checkpoint. Timer-based escalation, enforced externally.
• Decision Scope Boundary: Types of decisions the agent is authorized to make. A customer service agent can resolve billing disputes under $200 but must escalate contract termination requests regardless of dollar amount. Threshold-based human approval for high-impact decision categories.

Move78 recommendation: record the permitted task and corresponding technical constraints, then test how the system responds to attempted violations. A written policy or a log entry alone does not establish that the configured boundary is enforced.

Defense-in-Depth Containment

The Berkeley profile discusses layered containment for sufficiently capable agents. The six-layer list below is an illustrative Move78 design checklist, not a publisher-prescribed number of layers. Review dependencies between controls so that they do not all rely on the same component.

Six-Layer Defense Stack

• Layer 1 - Execution Environment Isolation: Run agents in sandboxed containers (VM, Docker, or cloud isolation). Prevent any agent process from accessing host-level resources, other tenants, or production infrastructure outside its scope.
• Layer 2 - Capability Restrictions: No shell access, no kernel-level operations, no filesystem writes outside designated directories. The agent can do what you've whitelisted; everything else is denied by default.
• Layer 3 - Network Isolation: Agents communicate only with approved endpoints. No arbitrary HTTP requests, no DNS resolution outside the whitelist, no lateral movement between services.
• Layer 4 - Monitoring: collect proportionate action, authorisation and intervention evidence. Test coverage and alert handling. Do not assume that a platform records every action or that raw prompts, secrets or private reasoning should be retained.
• Layer 5 - Circuit Breakers: define and test conditions for limiting or stopping activity, with explicit policy thresholds and an escalation path. Document which queued or delegated actions the mechanism can stop.
• Layer 6 - Operator Stop: provide an accessible stop mechanism, test its effect on active and delegated work, and record remaining limitations. Set a risk-based retest schedule and review it after material changes.

The profile's limitations discussion considers sufficiently capable agents as untrusted and recommends layered containment. This does not establish that a particular L4 or L5 label, system prompt or sandbox proves trustworthiness.

Move78 recommendation: test the deployed combination of model, configuration, tools and environment. Intended behaviour can differ from observed behaviour, and a containment test should examine how the system handles unexpected inputs and control failures.

Move78 recommendation: prioritise controls by the deployment's risks and test them together before granting consequential authority. Establish usable intervention and shutdown mechanisms before deployment rather than deferring them to a later phase. No incident-coverage percentage is established by this example.

Six-layer defense-in-depth containment for agentic systems

New Risk Categories for Agentic AI

The following are illustrative Move78 risk scenarios for agents. They are not an exhaustive or uniquely agentic taxonomy, and they do not establish that NIST AI RMF omits these risks. Review them alongside the profile's system-level risk guidance.

• Action Overreach: The agent takes actions beyond its intended scope - not through malice but through misinterpretation of goals, ambiguous instructions, or optimizing for a proxy metric that leads to unintended consequences.
• Tool-Chain Exploitation: An agent with access to multiple tools chains them in ways the designers didn't anticipate. For example, using a web search tool to find credentials, then using those credentials via an API tool to access restricted data.
• Inter-Agent Cascade: When agents delegate to other agents, a failure or misalignment in one agent cascades through the delegation chain. The orchestrating agent may not detect that a sub-agent has deviated from intended behavior.
• Autonomy Without Accountability: The agent operates at L4 or L5 autonomy but the governance structure still assumes L1 or L2 oversight. No one is monitoring, no one is accountable, and incidents are discovered through consequences rather than detection.

Use these scenarios to review the context, likelihood, impact and treatment evidence. The examples do not establish exact NIST subcategory or ISO control equivalence. The OWASP Agentic Top 10 guide provides a related security perspective.

Mapping to ISO 42001 and NIST AI RMF

The table below is a Move78 planning aid for coordinating management-system and risk workflows. Its themes are not a normative ISO clause crosswalk or a claim that the frameworks impose identical requirements. Confirm any exact ISO mapping against the licensed standard and the evidence for the particular control.

UC Berkeley vs Singapore IMDA

Berkeley and IMDA provide two resources for reviewing agentic AI governance. Berkeley's Agentic AI Profile, Version 1.0 complements NIST AI RMF and its own General-Purpose AI Profile. IMDA's Model AI Governance Framework for Agentic AI covers technical and non-technical deployment measures. The comparison below summarises their scope; select guidance that fits the system, deployment role and identified risks.

Move78 recommendation: compare the relevant recommendations with your existing controls and evidence gaps. Using either resource, or both, depends on the deployment context; neither resource establishes a universal requirement to adopt both. See the full IMDA implementation guide for the governance layer.

An agent decision evidence example

Scoped source check: 9 October 2026. NIST's 29 September update names DevSecOps as its first planned identity-and-authorisation implementation use case. Its comment summary reports proposals about scoped authority and delegated accountability, without consensus on a single implementation approach. Separately, Partnership on AI's 7 October assessment examined four agent frameworks against six monitoring goals and found gaps in their emitted telemetry. That assessed sample does not establish the behaviour of every framework.

Move78 implementation recommendation, synthetic example: for an attempted export, record agent/run document-assistant/demo-001; accountable owner/delegator service-owner; granted scope read approved documents; policy/version and decision documents-v2 / deny; tool/action reference export outside approved workspace; required intervention owner review; outcome blocked; and a retention/review owner and date proportionate to the organisation's purpose and obligations. This is an example to test in your environment, not a mandated schema or an ACT inclusion claim. Keep raw prompts, secrets and private reasoning traces out of this example record.

Practical Implementation Steps for SMEs

Move78 implementation recommendation: plan the work around your systems, owners and control gaps. The steps below are a review sequence, not a validated completion estimate for a given organisation or number of agents.

Common Mistakes to Avoid

The following are Move78 review prompts for common control-design pitfalls, not measured prevalence findings or a mandatory publisher checklist.

• Classifying only by intended use: review actual permissions, connected tools, autonomy and consequences together. Credentials alone do not determine an autonomy level.
• Relying on one shared failure point: test whether controls are sufficiently independent. A layer count alone does not demonstrate containment.
• Granting broad autonomy without a deployment decision: assess whether the permitted authority, safeguards and intervention evidence justify the intended use.
• Not testing containment mechanisms: test intervention and shutdown before use, after material changes and at a risk-based review frequency.
• Not translating guidance into evidence: assign an owner and a test or review record to each selected recommendation.
• Ignoring action-to-harm pathways: review how tool use, delegation and combined system behaviour could affect people or connected services.

Step-by-Step Implementation

Step 1: Describe autonomy and authority. Use an explicit scale as a communication aid and record actual task scope, access, human involvement and potential impacts.

Step 2: Define operational boundaries. Select limits appropriate to the task, data, tools and consequences. Record the policy decision, technical enforcement and exception or escalation path.

Step 3: Test layered containment. Choose independent safeguards appropriate to the identified risks and test intervention, rollback and shutdown before consequential use.

Step 4: Maintain a system record. As a Move78 documentation recommendation, record purpose, autonomy, access, boundaries, limitations and accountable owner, with review triggers for capability changes.

Step 5: Review agentic scenarios. Consider action overreach, unsafe tool combinations, cascading failures and accountability gaps as illustrative prompts alongside the risks already recorded for the system.