Worked example

This example shows why the raw product and authoritative route must both be explained.

Scenario

System: Claims Resolution Agent

Purpose: Triage insurance claims, retrieve customer and policy records, recommend outcomes and automatically settle claims below a financial threshold.

Deployment: Production, customer-facing service.

Users: Claims staff and policyholders.

Affected people: Claimants and dependants.

Data: Identity, financial, health-related and special-category information.

Tools: Claims platform, policy database, document store, payment service and customer messaging.

Oversight: Humans review exceptions and claims above the threshold; lower-value settlements can occur before review.

Step 1: intake facts

The intake records:

Operational production use.
Automated consequential decisions.
Human-on-the-loop oversight.
Personal and special-category data.
External customer interaction.
Payment capability.
High-impact insurance context.
Public-facing service.

These facts create a conservative automatic ACRS starting point.

Step 2: Operational Dependency

Assessment

Claims can continue manually for a limited period, but current staffing can process only 35% of normal daily volume. Backlog breaches the customer-service tolerance after two working days.

The fallback was exercised six months ago, but the exercise excluded payment reconciliation and customer messaging.

Evidence

Claims-service dependency map.
Business-impact analysis.
Manual fallback procedure.
Staffing and capacity model.
Partial continuity exercise.
Recovery runbook.

Level

Medium (2).

The service is materially dependent on the AI, but a bounded fallback exists. It is not Low because fallback cannot sustain normal volume and has not been tested end to end.

Finding

Complete an end-to-end fallback exercise including payment reconciliation and customer communications.

Step 3: Action Autonomy

Assessment

The agent can:

Request documents.
Update claim status.
Send customer communications.
Approve and release settlements below the threshold.
Retry failed payment operations.

Human approval occurs only for exceptions and higher-value claims. A primary approval gate exists, but an alternate payment tool can be called directly after a workflow retry.

Evidence and test

Tool manifest.
Runtime policy.
Action and approval logs.
Bounded alternate-path test using a synthetic claim and inert payment target.

The alternate-path denial test fails.

Level

High (3).

The system can produce consequential financial and customer effects before approval, and one path bypasses the intended gate.

Immediate containment

Disable the alternate payment tool in production until policy-enforced approval and a passed retest are in place.

Step 4: Access Scope

Assessment

The agent uses a dedicated service identity with:

Read access to policy and customer records.
Read access to health-related claim documents.
Write access to the claims platform.
Constrained payment authority.
Customer-message send authority.

Tenant boundaries and payment ceilings are enforced at the target. Credentials are short-lived and kept outside model context.

Evidence and test

Effective IAM policy.
OAuth scopes.
Credential-vault records.
Target-side authorisation rules.
Cross-tenant denial test.
Payment-ceiling test.
Access-review record.

Both denial tests pass.

Level

Medium (2).

The access is sensitive and operational, with constrained write and payment capability. It is not Low because special-category data and operational actions are reachable. The assessor does not call it High because privileged administration, arbitrary production execution and cross-tenant access are denied at authoritative boundaries.

Step 5: Harm Potential

Assessment

A manipulated or incorrect claim decision could:

Deny or delay essential financial support.
Discriminate against vulnerable claimants.
Expose health and financial information.
Trigger incorrect payment.
Create legal, regulatory and customer-remediation duties.
Affect many claims before complaint-based detection.

Appeal and correction exist, but cannot always restore lost opportunity or prevent distress.

Evidence and tabletop

Data-protection impact assessment.
Customer-outcome and fairness review.
Abuse-case analysis.
Complaint and appeal process.
Notification thresholds.
Tabletop covering manipulated documents and repeated incorrect denials.

The tabletop finds that complaint-based detection is too slow for a high-volume correlated failure.

Level

High (3).

Severe rights, financial, privacy and regulatory harm is credible. Probability is considered in the wider risk decision, not used to lower Harm.

Finding

Implement cohort-level outcome monitoring and automated detection for correlated denial anomalies.

Step 6: vector and product

dep:2, act:3, access:2, harm:3

Raw product:

2 × 3 × 2 × 3 = 36

The product tier is Medium.

Step 7: severity floors

The following floors apply:

Harm = 3, so the route cannot be Low.
Harm = 3 and Action ≥ 2, so the route is High.
Harm = 3 and Access ≥ 2, so the route is High.
Action = 3 and Access ≥ 2, so the route is High.
Automated consequential decisions in insurance with special-category data require a High route.

The authoritative routed tier is therefore High.

Step 8: GTSAF routing

The High route requires:

Baseline controls.
Enhanced controls.
Comprehensive relevant controls.

Priority areas include:

Agentic action governance and runtime approval.
Non-human identity and target-side authorisation.
Special-category data protection.
Human oversight and contestability.
Customer transparency and redress.
Fairness and outcome monitoring.
Incident response and notification.
Continuity and recovery.
Independent assessment.
Continuous monitoring.

Step 9: AI Assist review

The assessor runs whole-system AI Assist after selecting the Claims Resolution Agent.

The result:

Identifies the same High routed tier.
Highlights the approval bypass.
Recommends correlated-outcome monitoring.
Proposes a bounded rollback test.
Lists only validated, accepted evidence.
Flags that the continuity exercise is incomplete.

The assessor uses the recommendations to improve the finding and test plan. The AI result does not confirm the assessment.

Step 10: structured conclusion

Owner: Head of Claims Technology

Confidence: Medium

Residual risk: Above appetite until the approval bypass is closed and correlated-outcome monitoring is operational.

Review due: 60 days

Reassessment triggers: New payment tool; higher settlement threshold; change to oversight; additional health data; material supplier/model change; approval-bypass, cross-tenant or harmful outcome incident.

Assessor conclusion

The Claims Resolution Agent is assessed as dep:2, act:3, access:2, harm:3, raw product 36. Although the product tier is Medium, the authoritative ACRS route is High because the system combines severe credible harm, consequential pre-approval action, material operational access, special-category data and automated decisions in insurance. Production operation should remain restricted to the current settlement ceiling. The alternate payment path must remain disabled until policy-enforced approval and a passed bypass test are demonstrated. Confirmation is made with Medium confidence because fallback and correlated-outcome detection remain incomplete.

Lessons

The product tier is not always the authoritative route.
Harm severity is not reduced because probability appears low.
Effective access can be Medium even when data is highly sensitive, where privileged and cross-tenant paths are demonstrably denied; the High route can still be triggered by other facts.
Post-action review does not make consequential autonomy Low.
Failed tests affect scoring, findings and residual risk.
AI Assist improves analysis but does not approve it.
The final conclusion must state restrictions, uncertainty and reassessment triggers.