Skip to content
Apart Research
Apart Research
Contact us
Sprint projectFeb 2, 2026Jersey City

Technical AI Governance via an Agentic Bill of Materials and Risk Tiering

Anmol Kumar, Adarsh Vatsa, Dev Arpan Desai · Team Red Protocol

Submitted to The Technical AI Governance Challenge. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: Technical AI Governance via an Agentic Bill of Materials and Risk Tiering

Open in a new tab (opens in new tab)
Code (opens in new tab)
Share

This paper proposes a technical governance framework for agentic AI systems, autonomous agents with tools, memory, and self-directed behaviour, that current regulations do not adequately address. It introduces an Agentic Bill of Materials (ABOM), a machine-readable manifest that documents an agent’s capabilities, autonomy, memory, and safety controls; a quantitative risk scoring formula that computes agent risk from agency, autonomy, persistence, and mitigation factors; and a Unified Agentic Risk Tiering (UART) system that maps agents into five governance tiers aligned with the EU AI Act and international safety standards. Combined with hardware-based attestation, the framework enables verifiable, enforceable AI governance by allowing regulators to cryptographically verify agent configurations rather than relying on self-reported claims, and is validated through an open-source reference implementation.

Reviews

Judging this Sprint?

Review this project

Your public critique appears on this page without your name. Your private critique is not published; only the Apart team reads it. If you agree below, we share your review with grantmaking.ai (opens in new tab) and the Transformative AI Fund so strong projects can be funded.

Not shown on this page.

Shown on this page, without your name.

Only the Apart team reads this, and funders if you agree below.

Share my name publicly on grantmaking.ai *
Share my private critique with funders *

How much would this matter for AI safety if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical AI safety problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.

  1. The formula introduced for quantitative risk magnitude in their Risk Scoring Engine is quite dubious. I see no reason why one would expect risk to scale in the way implied by their formula.

  2. The biggest gap is empirical grounding: the ABOM and scoring engine should be tested on real deployed agent frameworks and validated against observed incident rates or expert judgments to move from concept to proven tool. The scoring also needs finer granularity, since treating all state-changing tools equally (e.g., database writes vs. arbitrary shell execution) weakens accuracy and calls for tool-specific impact weights. Finally, the framework should account for emergent model behaviors that can outstrip documented ABOM risk, and prioritizing hardware attestation would strengthen the core “verification without trust” claim. Solid foundation

Cite this project

@misc{kumar2026technical,
  title = {{Technical AI Governance via an Agentic Bill of Materials and Risk Tiering}},
  author = {Anmol Kumar and Adarsh Vatsa and Dev Arpan Desai},
  year = {2026},
  month = feb,
  note = {Submitted to The Technical AI Governance Challenge, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/technical-ai-governance-via-an-agentic-bill-of-materials-and-risk-tiering-uuts}},
  url = {https://apartresearch.com/sprints/projects/technical-ai-governance-via-an-agentic-bill-of-materials-and-risk-tiering-uuts}
}

More from The Technical AI Governance Challenge

All 47 entriesBrowse all projects

Build something like this at the next Sprint

AI Collusion Research Sprint · Oct 23 - 25, 2026