Register AI agents

Open AI agents

In the sidebar open Wizards and select the Artificial Intelligence card. Below the chapter list of the AI Compliance Assistant (AIMS) overview sit the tiles of the continuously kept tools; click the AI agents tile. The page shows the title with the Add agent button at the top, followed by the description and the legal basis. As long as no agent exists, the notice No agent recorded yet appears there.

The page belongs to no chapter of the assistant. There is no progress bar and no footer with Save & Continue; every agent is saved individually, and Back at the bottom of the page returns to the overview.

Enter name and base system

Click Add agent. A form with two fields opens below the page header: Name for the agent’s name and Base system with the selection Choose a system, which lists every system recorded in the AI inventory. The Create and fill in button becomes active once both fields are filled; Cancel closes the form again.

Create and fill in

Click Create and fill in. Cenedril creates an asset of type AI agents with the entered name in the asset register, links it to the base system’s asset through the relationship based on and opens the entry form. The risk class in it is already prefilled with the class of the base system. If an asset with the same name already exists, an error message appears; choose a different name then.

Choose and refine the purpose

The form carries the agent’s name as its title; below it a note says that ownership, protection need and autonomy are maintained on the asset itself in the asset register. In the Purpose field pick an entry from Choose a purpose. Only the purposes of use recorded for the base system in the chapter Inventory & Classification are available. If no purpose has been recorded for the system yet, the field shows an amber notice; add the purpose on the system’s Purposes of Use page and confirm the classification again. Under What exactly for describe in your own words what the agent does within that purpose.

Store the master prompt

Under Master prompt enter the instruction that guides the agent, including its guardrails: what it may do, what it refrains from and how it marks its output. The field is free text in a monospaced font; paste the prompt exactly as it is stored in the tool.

Check the risk class

The Risk class field is prefilled with the class of the base system; that entry carries the suffix same as the system. The options run from that class downwards: an agent that uses a narrower slice of the system may carry a lower class. As soon as you choose a lower class, the required field Reason for the lower class appears next to it. The entry is a note on the agent; the obligations of the system stay unchanged. If the base system has not been classified yet, the selection stays empty; classify the system first.

Record access to values

In the Access to values area you record which software systems, components and information the agent reaches. Attach a value opens the asset selection; choose Select Existing Asset, tick the values and confirm with Associate Asset (with several values Associate n Assets). Values of the categories Information and Software are available; the agent’s own asset is excluded. Every attached value appears as a card with the switches Read and Write. New values start on Read; switch to Write if the agent also changes the value. The X on the card removes the value again.

Select the applicable risks

The area Which risks of the system apply lists the risk scenarios from the risk analysis of the base system, each with the residual risk after the measures or the note not treated yet. All scenarios are preselected. Untick the risks that do not concern this agent; deselected scenarios appear greyed out. Cenedril stores per agent only the deselected risks: if a scenario is added to the base system later, it automatically applies to the agent as well. If no risk analysis exists for the system yet, the notice No risks have been recorded for this system yet. appears here.

Save the agent

Click Save agent. Cenedril reports Agent saved. and closes the form; the agent sits in the group of its base system in the list. The register is saved as a draft only: there is no publication and no record, and every change takes effect immediately. Cancel discards the entries of the form; a freshly created asset in the asset register remains.

Check groups and columns

The list groups all agents by base system. The group header shows the system’s name, its risk class and the number of agents; clicking the header collapses or expands the group. The columns per agent:

• Agent: name, below it the purpose and the entry from What exactly for.
• Looked after by: the responsible person from the asset register.
• Autonomy: the level from the asset register, from Suggests only to Acts on its own.
• Access: the number of attached values, split into read and write.
• Class: the agent’s effective risk class, with the note below system class for a lower class.

The pencil icon Edit reopens the form, the bin icon Remove agent takes the agent out of the register.

Add ownership, protection need and autonomy

The columns Looked after by and Autonomy show a dash until the agent’s asset in the asset register is filled in. Under Documentation → Assets open the entry of type AI agents and fill in the Business Owner, the Criticality and, in the type-specific section AI agents, the Autonomy. The options are Suggests only, Acts after approval, Acts on its own and reports and Acts on its own. The level describes how far a person has to intervene before the agent takes effect; the agent register shows it on the next visit.