Anthropic's deputy CISO scores agent risk in four questions

Anthropic's Deputy CISO Jason Clinton published a four-question triage for agent deployments on July 17. The pitch: stop treating 'is this agent safe' as a vibe check and start scoring it.

The four questions are specific. What untrusted content does the agent ingest. What actions can it take, and on whose behalf. What's the blast radius if it goes off the rails. And can your logs actually separate an agent's action from a user's action. Answer all four and you get a comparable risk score per use case instead of a shrug.

Clinton's framing matters as much as the questions. Zero risk isn't the goal, bounded and legible risk is. That's a real shift from the instinct to lock an agent down until it can't do anything useful. The guide treats risk as something you size and accept, not something you eliminate.

The fourth question is the one that trips people up. Plenty of solo builders can answer the first three in a sentence: it ingests scraped web pages, it can send emails or push code, the blast radius is 'wrong email, wrong person.' Fewer can say whether their logs separate what the agent did from what they clicked themselves. I've shipped agents that write to a database and call outside APIs, and the honest answer is you don't build that separation until something breaks and you need to reconstruct who did what.

Clinton calls it a ten-minute exercise. For most builders it's closer to homework they've been skipping.