High-risk agent gate
A high-risk agent without a current, second-person-approved AI impact assessment is held at run time: its writing tools, or the whole agent, are refused.
- Write and submit an AI impact assessment for an agent
- Sign one off as a second person
- Choose how strictly an unassessed high-risk agent is held
- Lift the hold for an emergency with break-glass
An agent whose registry risk tier is high must have an approved AI impact assessment that is current before it may act freely. Until it has one, the runtime holds it: by default it may still read, but every tool that can change something is refused. The assessment follows ISO/IEC 42001 Annex A.5 and the EU AI Act Art. 27 fundamental rights impact assessment.
An agent with no risk tier is never held, so the gate is safe on an instance that has not classified its agents yet. Set the tier on the agent's Registry tab (see Agent permissions).
The gate
TICKETIQ_AI_IMPACT_GATE (default writes) sets what a held agent is refused. You can also change it at run time with PATCH /api/settings and {"ai_impact_gate": "..."}.
| Level | A held agent |
|---|---|
off | Is not held |
writes (default) | Runs, but every tool that can change something is refused. Read tools still run |
all | Is refused at the door, before any model call |
A tool counts as writing when its connector or its pinned tool hints say it can change something. A tool nothing classifies counts as writing, and so does code mode's execute_code.
Lowering the level is a weakening: it needs governance.weaken and a reason, and it is audited.
Each refusal names the reason, for example that the agent has no approved assessment or which aspect changed since sign-off, and is audited as policy.denied with control=ai_impact. If the assessment cannot be read, the agent is held rather than let through.
When an agent is held
A high-risk agent is held while its assessment is not current:
| State | Meaning |
|---|---|
none | Never assessed |
draft, submitted, returned | A first assessment is being written, waits for sign-off, or was sent back |
reassess | An approved assessment exists, but the agent changed since sign-off or its review date passed |
current | An approved assessment is in force and not due. Not held |
An approval records the agent as it was: its model (including routing policy and embeddings, image and speech bindings), tools, instructions, data sources, intended purpose, risk tier and the Cedar policies that name it. When any of these changes, the assessment is due again and the agent is held again.
An approved assessment also falls due TICKETIQ_AI_IMPACT_REVIEW_DAYS after sign-off (default 365). 0 turns the periodic review off; a change to the agent still makes it due. This setting is environment-only.
Write and submit an assessment
Open Governance › Impact assessments (/impact) and pick the agent.
The questionnaire has five sections, each naming the clauses it covers:
| Section | Covers |
|---|---|
| Use and context | The processes it is used in, whether it stays within its registered purpose, period, frequency, its part in decisions about people |
| People affected | The groups affected, vulnerable people, scale |
| Rights and harms | A rating (none, low, medium, high) for each right, and the specific harms you foresee |
| Human oversight | Who oversees it, whether a person can stop or reverse it, whether overseers are trained |
| When harm happens | Mitigation, internal escalation, complaints, the GDPR DPIA, notice to the market surveillance authority |
- Answer the questions and choose Save draft. A draft may be partial.
- Choose Submit for sign-off. Every required question must be answered. Submission freezes the version and works out a residual impact (
low,mediumorhigh) and findings for the approver: for example a high-rated right, use outside the registered purpose, a decision taken with no review, no way to stop the agent, untrained overseers, or personal data at stake without a DPIA.
Nothing is edited after submission. A change is a new version, started from the last one's answers.
Sign off
A second person opens the same page and chooses Approve or Return.
- The approver needs
governance.writeand Cedarpromoteon the agent. - Anyone who wrote or submitted the version is refused (403), whatever their role.
- A return needs a reason. So does approving a version whose residual impact is
high. - An agent that changed between submission and sign-off cannot be approved: the approver would be signing off a different agent.
The approved version supersedes the one before, which is kept.
Break-glass
For an emergency that cannot wait for sign-off, Break glass lifts the hold on one agent (POST /api/agents/{key}/ai-impact/break-glass with reason and hours, default 4, at most 72). It needs governance.weaken and Cedar promote on the agent, and is audited as ai_impact.break_glass. End break-glass (DELETE on the same route, governance.write) ends it early.
Routes and permissions
| Question | Endpoint | Permission |
|---|---|---|
| The questionnaire | GET /api/ai-impact/questionnaire | agents.list |
| Every agent's standing, those needing one first | GET /api/ai-impact/register | agents.list |
One agent's assessment and its hold (gate: level, held, why, break-glass) | GET /api/agents/{key}/ai-impact | agents.get |
| One version whole | GET /api/agents/{key}/ai-impact/versions/{n} | agents.get |
| Save the draft | PUT /api/agents/{key}/ai-impact/draft | agents.update |
| Submit | POST /api/agents/{key}/ai-impact/submit | agents.update |
Approve or return (decision: approved or returned) | POST /api/agents/{key}/ai-impact/versions/{n}/decision | governance.write |
| Break-glass | POST /api/agents/{key}/ai-impact/break-glass | governance.weaken |
| End break-glass | DELETE /api/agents/{key}/ai-impact/break-glass | governance.write |
Reading an agent's assessment also checks Cedar get on it; writing checks Cedar update.
GET /api/agents/{key}/risk is a different measure: the agent's risk score from its triaged detector firings. It does not decide the gate.
Audit
ai_impact.draft.save, ai_impact.submit, ai_impact.decision, ai_impact.break_glass, ai_impact.break_glass.end, and policy.denied with control=ai_impact for each refusal. Answers are free text about people, so audit rows name sections and findings, never the answers.