AURA: An Agent Autonomy Risk Assessment Framework

Authors

Lorenzo Satta Chiris, Ayush Mishra (University of Exeter)

Abstract

As autonomous agentic AI systems see increasing adoption across organisations, persistent challenges in alignment, governance, and risk management threaten to impede deployment at scale. We present AURA (Agent aUtonomy Risk Assessment), a unified framework designed to detect, quantify, and mitigate risks arising from agentic AI. Building on recent research and practical deployments, AURA introduces a gamma-based risk scoring methodology that balances risk assessment accuracy with computational efficiency and practical considerations. AURA provides an interactive process to score, evaluate and mitigate the risks of running one or multiple AI Agents, synchronously or asynchronously (autonomously). The framework is engineered for Human-in-the-Loop (HITL) oversight and presents Agent-to-Human (A2H) communication mechanisms, allowing for seamless integration with agentic systems for autonomous self-assessment, rendering it interoperable with established protocols (MCP and A2A) and tools. AURA supports a responsible and transparent adoption of agentic AI and provides robust risk detection and mitigation while balancing computational resources, positioning it as a critical enabler for large-scale, governable agentic AI in enterprise environments.

Keywords: Alignment, Agentic AI, AI Safety, Human-In-The-Loop, Agent Autonomy, Agentic Risks

Introduction

As agents' performance improve and benchmarks are surpassed, widespread organisational and societal demand for production-ready systems is poised to rise, leading AI agents to be entrusted with progressively challenging, complex and impactful tasks. Nevertheless, persistent vulnerabilities and concerns leave enterprises and individuals hesitant to deploy agentic AI in production environments.

This paper introduces AURA (Agent aUtonomy Risk Assessment), a foundational framework for evaluating actions of AI agents. LLM-powered agents, software systems acting autonomously towards goals, inherently possess decision-making autonomy enabling them to perform real-world impactful actions. Within these capabilities, the deployment of agent tools and LLM-derived actions represent the greatest source of risk.

Related Work

LLMs as Autonomous Risk Evaluators

The concept of adaptive capacity, defined as the ability of people and systems to handle unexpected situations successfully, is identified as a fundamental step in overcoming a defined difficulty in ethical and risk evaluation tool usability and practical deployment.

Limitations of LLM-based Risk Evaluation

LLMs fail to develop inductive biases towards the underlying world model when adapted to new tasks. LLM risk scoring introduces an accountability gap: as autonomy increases, risks multiply and explainability rapidly diminishes.

Balancing Autonomy and Oversight: The Alignment Challenge

The question of autonomy and alignment oblige to find a balance between autonomy and oversight, moving the problem from finding answers to asking the right questions.

Towards Integrated Evaluation Frameworks

Given the shortcomings of LLM as risk evaluators, and the inherent complexity of risk scoring, autonomous LLM-powered multi-agent systems represent a strategic response to autonomy and alignment challenges.

The Aura Framework

Framework Architecture Overview

AURA addresses the absence of unified tools for evaluating risks in agentic AI by providing a modular process for comprehensive assessment and mitigation of agent actions.

Core Constructs:

• Agent: An AI system capable of performing discrete actions.
• Action: The atomic unit of behaviour undertaken by an agent.
• Context: The situational information conditioning an action.
• Dimension: A factor along which risk is analysed.
• Score: The quantified risk value assigned to an action–context pair.
• Weight: The relative importance assigned to a context or dimension.
• Gamma score (γ): The aggregated and normalised measure of overall risk.
• Risk Profile: A structured representation of an action's risk.
• Mitigation: A safeguard applied to reduce risk exposure.
• Human-in-the-Loop (HITL): A refinement mechanism with human oversight.
• Memory Unit: A persistent module that stores past actions, scores, contexts.
• Agent-to-Human (A2H), Traces: A communication and control layer.

The AURA Process

Decomposition – Break The Agent Into Actions For Assessment

Contextualisation – Parse Each Action Into Its Operational Context

Dimension Identification – Generate Candidate Risk Dimensions

Scoring – Quantify Risk For Each Context–Dimension Pair

Risk Profiling – Aggregate Scores Into Gamma Metrics

Mitigation – Identify Candidate Safeguards

Observability And Control – Ensure Transparency

The Scoring Process

Raw Gamma Score: γ_action = Σ_d u_d (Σ_c p_{c|d} s_{c,d}) Normalised Gamma: γ_norm = 100 × (γ_action / U_tot) ∈ [0, 100] Variance: σ²_γ = (1/U_tot) Σ_c Σ_d w_{c,d} (s_{c,d} - s̄_w)²

Interpretation:

• Low γ, low σ²: Low overall risk, evenly spread
• Low γ, high σ²: Low average risk, concentrated in some pairs
• High γ, low σ²: High, uniform risk (systemic issue)
• High γ, high σ²: High, concentrated risk – priority "hot-spots"

Dimensions

Dimensions represent fundamental axes along which an agent's actions can generate risk. Core dimensions include: Accountability/Governance, Transparency/Explicability, Fairness/Bias, Privacy/Data Protection, Human Oversight/Autonomy.

Risk Analysis and Risk Profile

Risk Thresholds: 0-30 (Low), 30-60 (Medium), 60-100 (High) Analysis Methods: Dimension Radar Graph, Share Bars, Score Distribution, Context-Dimension Correlations, Risk Clusters

The Memory Engine

A memory unit caches prior decisions for one-shot or partial retrieval. Actions: No-Duplicate Rule, Similarity Search, Exact Match, Near Match, No Match, Insertion Rule, Mitigation Selection.

The HITL and A2H Systems

Human-in-the-Loop (HITL) System: Question-based system for iterative fine-tuning. Agent-to-Human (A2H) System: Memory control interface for inspection and editing.

Mitigation Strategies

Mitigations are active control layers that constrain, guide, and recalibrate agent behaviour. Selection Policy: Memory, LLM Generation, Human Oversight, Rule-Based Primitives: Grounding, Guardrails, Threshold gating, Agent review, Role-based escalation, Memory overrides, Meta-logic, Custom/learned

The Framework In Practice

Implementation

AURA is implemented as a lightweight, open-source Python framework with an optional web-service interface.

Sample Case Study

Autonomous Web Agent for Signups and Form Filling - demonstrating risk assessment with γ_norm = 0.58 triggering confirmation and verification mitigations.

Operational Integration

Deployment scales from individuals to enterprises

Modularity, Adaptability, and Evolution

Conclusion

AURA provides a unified foundation for assessing, monitoring, and mitigating risks in agentic AI. Future directions include domain-specific specializations, memory generalization, and cross-agent learning networks.

ACKNOWLEDGMENTS We gratefully acknowledge Prof. Zhou Zhou for constructive feedback and assistance in reviewing this paper.

Paper: https://lsattachiris.com/aura PDF: https://lsattachiris.com/aura.pdf