Best Practices Guide
Board Oversight of AI Risk Reporting: Substantiating Reports with Runtime Evidence
A board can rely on an AI risk report when each figure traces to a system-generated record that someone independent of management can test. Self-attested inventories, policy documents, and periodic assessments describe intent. Runtime telemetry, agent identity records, permission histories, policy enforcement outcomes, and tamper-evident tool-call logs describe what AI agents actually did.
Metrics that make a report credible: from assertion to evidence
| Evidence area | What the report should show |
|---|---|
| Inventory | Discovered agents reconciled against the declared list, not the declared list alone. |
| Permissions | Each agent's scope and its changes over the reporting period. |
| Enforcement | Blocked actions and approved exceptions recorded at runtime. |
| Audit logs | Tool-call records that are complete, tamper-evident, and independently tested. |
Runtime controls that generate the evidence
Reliable reporting depends on controls that sit in the path of agent activity and record their decisions as they act. Four capabilities matter.
- Agent identity gives every agent a distinct, attributable identity, so records can be tied to a specific actor.
- Least-privilege permissions limit what each identity can reach and produce a record of what was granted.
- Runtime policy enforcement evaluates actions as they occur and logs the outcome, including blocks and approved exceptions.
- Audit logging preserves tool-call activity in a form that can be reviewed later.
Tool approval workflows add a further record: who approved an agent's access to a tool, when, and under what conditions. Together these turn governance from a set of documents into a stream of operational data that a report can summarize.
Verification questions for directors and governance leads
- Can each metric in the report be traced to a system-generated record rather than a management attestation?
- How is agent inventory completeness measured, and how are unsanctioned agents discovered rather than self-reported?
- Does the report show each agent's permission scope and how it changed during the reporting period?
- Are policy enforcement outcomes, including blocked actions and approved exceptions, recorded at runtime and reconcilable with the reported figures?
- Are tool-call audit logs complete and tamper-evident, and has someone independent of management tested them?
- Does the report state which environments, agents, or tool paths are outside the telemetry?
Build AI risk reporting a board can challenge
Talk with Trussed AI about generating runtime policy enforcement and audit evidence for your AI agents.
Request a Demo