Assessment workflow

Use this workflow to produce a defensible, system-specific ACRS assessment.

Before starting

Confirm:

You are in the correct tenant and workspace.
The correct AI system intake exists and is selected.
The system purpose, owner, lifecycle and deployment are current.
Autonomy, oversight, data, retrieval and impact fields describe the deployed or proposed use.
You have authority to view or edit the assessment.
The assessment scope is not a workspace scratch profile unless that is deliberate.

Step 1: select the AI system

Choose the named system intake before scoring or using AI Assist.

Record the system boundary clearly:

Business service and use case.
Deployment environment.
Model and supplier.
Users and affected persons.
Data sources and destinations.
Tools, integrations and effective identities.
Decisions and actions.
Human-oversight points.
Fallback and recovery path.

If the boundary contains several materially different agents or workflows, assess the system route and use agent-level ACRS in Agentic CISO where individual capability differences need separate governance.

Step 2: validate the intake

Review the fields that drive automatic inference:

Autonomy level.
Human oversight.
Automated-decision flag.
High-risk flag.
Personal and special-category data.
Retrieval sources and external retrieval.
Public-facing status.
Community, cultural or heritage impact.
Lifecycle and deployment.
System purpose, users, affected people and regulatory exposure.

Resolve inconsistent fields before relying on the score. Automatic inference is only as good as the recorded system facts.

Step 3: review the automatic suggestions

For each dimension, inspect:

The inferred level.
The active level.
Whether the active value is inferred or assessor-entered.
The advisory and scoring anchors.
Any contradiction or below-floor warning.

Do not treat inference as a conclusion. It is a conservative starting point designed to prevent a blank or optimistic intake from silently producing no route.

Step 4: assess Operational Dependency

Determine:

What stops or becomes unsafe if the AI is wrong or unavailable.
Time to material impact.
Manual or technical fallback capacity.
Supplier and integration dependencies.
Recovery objective and restoration completeness.
Whether fallback works at realistic demand.

Use the dimension playbook to collect evidence and run a bounded continuity exercise.

Step 5: assess Action Autonomy

Trace the workflow from trigger to terminal effect:

Decisions and actions.
Approval gates.
Alternate APIs and tools.
Retries and long-running tasks.
Delegation and sub-agents.
Kill switch, rollback and compensation.
Human detection and intervention time.

Approval must occur before the consequential effect to support a Low conclusion.

Step 6: assess Access Scope

Build an effective permission path:

Initiating user.
AI or service principal.
Tool or connector.
Target system.
Data classification.
Read, write, execute, delete or send authority.
Credential scope and lifetime.
Tenant, network and environment boundaries.

Score what is technically reachable, not what the prompt says the AI should use.

Step 7: assess Harm Potential

Construct credible adverse scenarios:

Ordinary error.
Prompt injection or manipulation.
Compromise or malicious use.
Correlated or repeated failure.
Scale and propagation.
Detection and containment.
Reversibility, appeal, redress and recovery.

Harm describes consequence severity. Low probability does not turn severe harm into Low Harm.

Step 8: justify assessor overrides

For every explicit level:

State the boundary assessed.
Cite the facts and evidence considered.
Explain why the selected anchor fits.
Identify uncertainty.
Record the change that would make the score invalid.

For a lower-than-inferred level, explain why the inference signal does not represent the effective deployed capability and identify the technical or operational evidence supporting the reduction.

Step 9: review product and severity floors

Check:

Vector.
Raw product.
Product tier.
Every severity-floor reason.
Authoritative routed tier.

Do not overwrite a High routed tier with a Medium product tier in narrative or reporting.

Step 10: link evidence, tests and findings

For each dimension:

Link objective evidence.
Create evidence requests where records are missing.
Record bounded tests and pass criteria.
Raise findings for material gaps, failed tests or unsupported assumptions.

Assessor rationale remains separate from evidence. A detailed narrative does not become accepted evidence automatically.

Step 11: use AI Assist where helpful

AI Assist can analyse:

The whole selected system; or
One selected dimension.

Before using the result, verify:

The displayed system name and reference.
The current vector and basis.
The evidence records the model was allowed to treat as accepted.
The recommended score against the authoritative route.
The proposed test’s safety limits.

AI output is advisory and requires human approval.

Step 12: record the structured assessor conclusion

The conclusion panel requires:

Field	What to record
Assessment owner	The accountable person responsible for the ACRS conclusion.
Confidence	Low, Medium or High confidence in the assessment basis.
Residual risk	The remaining risk after current controls, limitations and uncertainties.
Review due	A date proportionate to exposure and change rate.
Assessor conclusion	A concise, defensible statement of the vector, route and decision relevance.
Reassessment triggers	Specific changes or events that require review.

The conclusion is human-authored and remains separate from AI output and evidence acceptance.

Example conclusion

The system is assessed as dep:2, act:3, access:2, harm:3, raw product 36. The authoritative route is High because severe harm is combined with consequential autonomy and material access. Current approval and rollback controls reduce residual risk but do not change the capability exposure. Production expansion is conditional on closure of the approval-bypass finding and a passed rollback exercise.

Step 13: confirm the assessment

Confirm only when:

Contradictions are resolved.
Lower-than-inferred overrides are justified.
The system scope is correct.
Evidence and tests are sufficient for the claimed confidence.
Findings and residual risk are visible.
The accountable human accepts the recorded conclusion.

Confirmation signs the current assessment basis. It does not accept deployment or residual risk unless the organisation’s separate governance process explicitly records those decisions.

Step 14: route and continue assurance work

Use the accepted ACRS route to:

Set proportionate GTSAF assurance depth without changing factual control applicability.
Prioritise dimension-relevant controls.
Set evidence and test rigour.
Inform MAESTRO threat modelling.
Set Gateway approval and runtime-policy expectations.
Inform ATF autonomy decisions.
Establish monitoring and reassessment cadence.

Resetting assessor overrides

Reset assessor overrides clears:

Explicit dimension levels.
Dimension rationales.
Structured conclusion fields.
Confirmation tied to those overrides.

It does not disable automatic system-generated scoring. Gamut recalculates from the current intake facts.