Risk and compliance

The Risk and compliance screen lets you assess the risk of an agent or a model (EU AI Act category), record the controls of the tenant and map them to the frameworks, request a time bound exception to a control, and read the evidence collected for each control. Portal path: /security/risk, menu Security and governance > Risk and compliance. It is used by security officers, tenant administrators, AI governance officers and developers who prepare an audit.

What the screen shows

The screen (Risk in portal/src/screens/security.tsx) has four tabs.

• Assessments: table read from GET /v1/risk/assessments, columns Target type (target.type), Target (target.ref), Use cases, EU AI Act category, Risk, Status, Created. A click on a row shows the row (rationale, obligations, answers).
• Controls: table read from GET /v1/risk/controls, columns Code, Title, Frameworks, Status, Owner, Evidence (number of evidence records), Active exceptions.
• Exceptions: the Request an exception form ("Time bound exception to a control, with justification."), then the Exceptions table read from GET /v1/risk/exceptions, columns Control, Target, Reason, Approver, Requested by, Status (active, expired, revoked), Expires.
• Evidence: table read from GET /v1/risk/evidence, the recorded evidence followed by the evidence collected automatically from the platform, columns Control, Title, Kind, Frameworks, Metrics, Collected.

Forms of the screen:

Form	Field	Required	Notes
New assessment	Target	yes	type:ref, for example agent:invoice-assistant or model:claude-sonnet-eu.
	Use cases	no	Comma separated, for example customer_support, credit_scoring.
	Answers	no	JSON object of the questionnaire, default {}.
	Owner	no	Default: you.
New control	Code	yes	Up to 64 characters; an existing code is updated.
	Title	yes
	Description	no
	Frameworks	no	JSON, keys eu_ai_act, gdpr, iso_42001, nist_ai_rmf.
	Owner	no	Default: you.
	Status	no	Choices planned, partial, implemented.
Request an exception	Control (control_code or control_id) or Target (target_ref)	one of them	For example AC-1 or agent:invoice-assistant.
	Reason	yes	At least 3 characters.
	Compensating controls	no
	Approver	yes	Must be another person than you.
	Expires	yes	ISO date in the future, at most 365 days ahead (2026-12-31T00:00:00Z).

Actions

Button or action	What it does	API call	Roles
New assessment (then Create)	Classifies the target from its use cases and answers, stores the assessment and, for an agent, copies the category to its risk level (registry_synced).	POST /v1/risk/assessments	tenant_admin, security_officer, developer, ai_governance_officer
New control (then Create)	Creates the control, or updates the control with the same code.	POST /v1/risk/controls	tenant_admin, security_officer
Run (Request an exception)	Records the exception with its approver and expiry; audited as risk.exception.create.	POST /v1/risk/exceptions	tenant_admin, security_officer, developer
Row click (Assessments, Exceptions, Evidence)	Shows the row in a side panel, without another call.	None	Every user of the tenant
Refresh icon of a table	Reads the list again.	GET /v1/risk/assessments, GET /v1/risk/controls, GET /v1/risk/exceptions or GET /v1/risk/evidence	Every user of the tenant
Retry (error state)	Reads the failed list again.	The route of the tab	Every user of the tenant

Roles

The portal hides no button on this screen. The Control Plane checks the roles (services/control-plane/src/eai/domains/risk/__init__.py):

• reading every tab: any user of the tenant;
• assessment: tenant_admin, security_officer, developer or ai_governance_officer; only tenant_admin, security_officer or ai_governance_officer may store it with the status approved;
• control: tenant_admin or security_officer;
• exception: tenant_admin, security_officer or developer, and the approver must differ from the requester (separation of duties);
• platform_admin passes every role check.

Typical tasks

Classify a new agent before production

1. Open the form. The category drives the obligations of the EU AI Act. In Assessments, click New assessment. Expected result: a side panel with Target, Use cases, Answers, Owner. If it fails: no button means the list did not load; click Retry.
2. Describe the target. Enter agent:<name> in Target and its use cases, for example customer_support. Expected result: the form accepts the values. If it fails: "Invalid JSON" under Answers means the JSON does not parse.
3. Create. Click Create. Expected result: the message Created and a new row with its EU AI Act category. If it fails: forbidden (HTTP 403) means a missing role.
4. Check the registry. For an agent, the category is copied to its risk level. Open the Governance registry, tab Agents. Expected result: the Risk column shows the category. If it fails: the target name does not match the name or the identifier of the agent.

Record a temporary exception to a control

1. Find the control. The exception refers to its code. In Controls, note the Code, for example AC-1. Expected result: the code of the control. If it fails: create the control first with New control.
2. Fill the request. Tab Exceptions, form Request an exception: Control, Reason, Compensating controls, Approver (another person) and Expires. Expected result: the form is complete. If it fails: nothing to retry at this step.
3. Send it. Click Run. Expected result: the result panel shows the exception with the status active; click the refresh icon of Exceptions to see the new row. If it fails: invalid_exception (HTTP 422) means an expiry in the past or more than 365 days ahead; separation_of_duties (HTTP 409) means you named yourself as approver; not_found means the control code is unknown.

Gather the evidence of a control

1. Open the evidence. It is collected from the audit events and the evaluations. Tab Evidence. Expected result: the recorded evidence, then the automatic one (for example EAI-LOG-01 with the state of the audit chain). If it fails: "No evidence collected" means nothing was recorded yet.
2. Read the metrics. The automatic rows count what the platform holds (agents, models, assessments, DLP rules, keys, runs). Read Metrics for the control. Expected result: the counts used as proof. If it fails: an empty metric means the source table does not exist in this deployment.

Troubleshooting

Symptom	Cause	Fix
invalid_request (HTTP 400) with status when creating a control	The API accepts planned, implemented, partially_implemented or not_applicable; the choice partial of the form is refused.	Choose planned or implemented, or send partially_implemented through the API.
invalid_request with frameworks	A framework key outside iso_42001, nist_ai_rmf, gdpr, eu_ai_act.	Use only these keys in Frameworks.
invalid_exception (HTTP 422)	Expires is in the past or more than 365 days ahead.	Choose a date within the next 365 days.
separation_of_duties (HTTP 409)	The approver is the requester.	Name another person as Approver.
invalid_request with required on an exception	None of Control or Target was filled.	Fill a control code, a control id or a target.
not_found with risk_control	The control code or id is unknown.	Check the code in the Controls tab.
forbidden (HTTP 403) with required_roles	Your roles do not allow this write.	Ask for one of the listed roles.
tenant_required (HTTP 403)	The account acts without a tenant.	Sign in with an account of the tenant.

Related pages

• Governance registry
• Incidents
• Evidence and seals
• Risk and compliance brick
• Audit evidence