How to Measure Residual Risk in Autonomous AI Agents: The CPSAINT and FRIESA-K Framework

In July 2026, researchers published on arXiv a framework for quantifying the residual risk of agentic AI. It pairs two models, CPSAINT and FRIESA-K, and converts each failure scenario of an autonomous agent into a concrete numerical risk value.

What problem are the authors solving?

Agentic AI is gaining access to real-world actions, such as placing orders, making payments and controlling robots, faster than risk-assessment methods can keep up. According to the authors, existing approaches give only half of the picture: some describe failure mechanisms but produce no transferable estimate of residual risk, while others calculate risk but treat the internal failure path as a black box.

"Agentic AI crosses trust boundaries faster than current risk models

can describe," the authors write in the abstract of the arXiv paper.

CPSAINT and FRIESA-K combine both views. First they decompose the system into layers where a failure can occur, then they map each valid failure path to a strictly defined numerical risk score. The authors call this structural composability: a formal link between a valid failure path and a well-defined "risk instance."

What does the framework consist of?

CPSAINT is a seven-layer decomposition of agent integrity, where each layer covers a separate point at which the system's integrity can break down. Together with the FRIESA-K functional, it forms a "from mechanism to magnitude" pipeline for robust agentic and embodied AI.

• The seven CPSAINT layers: physical state, sensors, data, computation, actuators, environment and time
• FRIESA-K is a residual-risk functional: each failure path is mapped to a numerical score
• The resistance term K is derived from a controlled absorbing Markov model rather than assigned by eye
• Governance observability is handled as a separate additive penalty, not as a new variable inside the functional
• The framework is validated on two contrasting scenarios: a warehouse robot and a financial agent

Why does the resistance term K matter?

The key difference in FRIESA-K is how the "resistance" K, meaning the effectiveness of controls, is calculated. Instead of an informal expert estimate, the authors tie K to the system's state dynamics through a controlled absorbing Markov model. Control effectiveness is therefore derived from how the system actually moves between states and gets "absorbed" by a failure, not from a subjective score. Governance observability is pulled out into a separate additive penalty, so that the system's governability is not mixed up with its technical robustness and neither is substituted for the other inside the same formula.

Where was the framework tested?

The framework was run on two deliberately different scenarios: a hard-real-time warehouse robot and a financial agent equipped with governance tools. According to the authors, in both cases the same grammar of seven layers, the same variable semantics and the same dynamic-resistance construction held up. In other words, one and the same "core" apparatus describes both a physical robot with strict timing requirements and a purely software agent in financial services, without reinventing the model for each domain.

What does this mean?

The work offers a compact core that links a failure mechanism to its risk magnitude and lets people reason about trust in agents across different domains in a common language. For an industry in which AI agents increasingly get access to money and physical actions, a transferable and verifiable estimate of residual risk is a step away from vague "safety assessments" toward numbers backed by state dynamics rather than expert intuition.