Insider Risk (AI Agent)

Traditional human-focused DLP and endpoint tools cannot see the non-human actor — the AI agent — yet that actor makes tool calls, invokes APIs, and emits model output at machine speed. Insider Risk governs exactly this surface. It computes Agent Risk Indicators (ARIs) live from DLP, tool-approval, and usage signals across exfiltration, manipulation, boundary, and anomaly categories; supports custom ARI authoring; risk-scores every agent and the org as a whole; provides AI incident case management; and applies adaptive enforcement — including inline, in-gateway blocking or step-up of an agent whose risk crosses a threshold before the request reaches the provider. See §7.22.