AI Agent Control Gap Assessment: A Structured 10-Day Method
An AI agent control gap assessment is a time-boxed review that inventories agent identities, permissions, and tool-call access, then compares them against actual runtime behavior to find where granted privileges exceed operational need or where enforcement is missing. A 10-day version scopes the exercise to discovery, evaluation, and a prioritized remediation roadmap rather than full remediation itself.
The 10-Day Assessment Structure
The assessment is intentionally bounded: it produces a prioritized findings report within a scope stakeholders can commit resources to, rather than attempting full remediation in the same window.
- 01
Discovery and evaluation over a fixed 10-day window
Five Control Categories in Scope
Each assessment day maps back to one or more of these five categories, which together define the boundary between what an agent is provisioned to do and what it actually does at runtime.
Identity
Agent service identity versus delegated human identity.
Permissions
IAM roles and tool-specific scopes granted to each agent.
Tool-call governance
What tools an agent can invoke and under what conditions.
Runtime enforcement
Whether policy is checked at execution time, not just at provisioning.
Auditability
Whether logs capture agent, identity, tool, and parameters.
Why Enterprises Lack Visibility Into Agent Permissions
Most enterprises deploying AI agents cannot produce a complete answer to a simple question: what can each agent actually do. Permissions are often granted incrementally during development, tool access is added through orchestration frameworks or Model Context Protocol (MCP) servers without central review, and no single system holds a full inventory of active agents and their scopes. This mirrors a pattern OWASP's agentic AI security guidance identifies as "excessive agency," where agents accumulate broader permissions than any single task requires. Unlike a static over-privileged service account, an agent's exposure changes as its capabilities expand, making point-in-time provisioning reviews insufficient on their own.
Why a Time-Boxed Assessment Is the Right Starting Point
A 10-day assessment window is not drawn from a published standard. NIST's AI Risk Management Framework explicitly leaves assessment cadence to organizational risk tolerance rather than prescribing a timeline. The 10-day structure used here is an operational framing intended to produce a defensible, prioritized findings report within a scope that stakeholders can commit resources to. It is deliberately bounded to discovery and evaluation. Deep remediation validation, including confirming that fixes hold under production load, typically extends beyond the assessment itself and should be scoped separately.
Where Gaps Typically Concentrate
Technical review consistently surfaces gaps at protocol boundaries and in the difference between design-time and runtime permissions. MCP separates hosts, clients, and servers, and permission gaps can occur at any of these three boundaries rather than in a single layer. An agent may hold unused scopes that were granted during development and never revoked, meaning documented permissions review alone understates real exposure. Runtime policy enforcement addresses this by evaluating each tool call against policy at the moment of execution, rather than relying solely on what was provisioned. Assessments that skip this runtime comparison and rely only on static configuration review will consistently miss gaps between intended and actual agent behavior.
Design-time versus runtime
A permissions document describes what an agent was granted. Runtime enforcement describes what an agent is actually allowed to do at the moment it acts. An assessment limited to the former will understate real exposure.
Practical Considerations for the Assessment
- Disclose sampling limitations: Exhaustive log review is rarely feasible in 10 days. Sampling-based review is pragmatic but should be stated explicitly as a limitation in the final report.
- Use an external risk taxonomy: Classify findings against OWASP's agentic risk categories or NIST AI RMF functions rather than an internally invented scale, since no single regulatory standard currently governs AI agent permissions.
- Separate agent and human identity: Distinguish an agent's own service identity from any human identity it acts on behalf of when evaluating access and building the audit trail.
- Validate MCP server-side enforcement: Confirm that MCP servers independently validate authorization and token scope rather than trusting client-side controls, per current MCP specification guidance.
- Prioritize by blast radius: Rank findings by exploitability and potential impact, such as write access to production systems, ahead of findings that are numerous but low-consequence.
Governance Reporting and Next Steps
NIST AI RMF's Govern function expects documented accountability for AI system risk decisions, and CISA guidance treats AI system inventories as a baseline compliance artifact rather than an optional security exercise. A gap assessment report should map its findings to these expectations explicitly, stating which framework was used as the evaluation baseline and where evidence was incomplete due to logging gaps or time constraints. This makes the assessment defensible to auditors and gives governance leaders a concrete basis for prioritizing remediation investment rather than relying on generalized risk statements. Trussed AI provides runtime governance and security capabilities, including agent identity, least-privilege enforcement, tool approval workflows, and audit logging, that support acting on findings once an assessment identifies where enforcement is missing.
Turn Assessment Findings Into Enforced Controls
Identifying control gaps is the first step. Closing them requires runtime enforcement of identity, permissions, and tool-call policy, not just documentation.
Explore Runtime Governance