The Board Doesn’t Know Who to Ask: A Unified Reporting Model for Cross-Functional Agentic AI Risk

The Board Doesn’t Know Who to Ask examines the governance challenges organizations face as autonomous AI agents gain authority to make decisions, access systems, and execute actions. The paper introduces the Agentic Risk Reporting Spine (ARRS), a framework designed to unify accountability, risk, controls, human oversight, behavior, and business impact. It also outlines an Agent Mandate, six levels of autonomy, cross-functional RACI+ roles, board-level metrics, and a four-view reporting model. By connecting traditionally siloed functions, the framework helps leaders identify ownership, monitor systemic and multi-agent risks, strengthen oversight, and scale agentic AI with clearer accountability and continuous assurance.