Get a GRASP: How to create real risk visibility for AI agents

Frameworks like NIST and the NSW AI Assessment Framework are valuable for policy, assurance, and audit—but they’re often too heavy to keep up with emergent agent use inside enterprises. The biggest risk surface is no longer only “official” AI projects; it’s user-configured tools (copilots, workflow builders, agent platforms) where new agent behaviours and capabilities emerge quickly, often configured by less technical users. Get a GRASP introduces a lightweight, implementation-first method that complements formal frameworks by creating fast, repeatable risk visibility for AI agents: what they can do, how far they can reach, what they’re allowed to change, what safeguards exist, and the blast radius if they fail. Outcomes: - Lower discovery friction: reduce clarifying back-and-forth between builders and risk teams per agent assessment. - Faster decisions: shorten median time from agent/use-case proposal to risk decision. - Stronger risk positioning: Ensure you are in appetite by reducing the shadow AI emerging throughout the organisation.