Risk coverage and capability delivery
Source: deck slides 10–17 · Wrike AI & MCP Readiness Programme
Risk coverage and capability delivery#
A shared capability can address multiple risks. The next view groups features into an execution plan.
| Risk view | Capability view |
|---|---|
| What could go wrong? | What do we need to deliver? |
| Review each risk and the controls it needs. | Group shared features with their risk coverage. |
| The same features can appear across risks. | Confirm ownership and pilot or rollout needs. |
Example: one capability, multiple risks#
Agent Registry
- #1 Governance & Accountability
- #7 Monitoring & Visibility
- #11 Agent Sprawl
- #21 External AI Platform
Decision focus: agree capability priorities, accountable owners and readiness gates.
CD1. Governance & Lifecycle Management#
Control registration, approval, ownership health, reactivation and retirement. · Slide 11
| ID | Capability | Risks Addressed | AI Agent | MCP | Owner | Required For |
|---|---|---|---|---|---|---|
| CD1.1 | Agent Registry | #1, #7, #11, #21 | Yes | Yes | Wrike Product Team + Global Wrike Team | Pilot |
| CD1.2 | Agent Approval Workflow + Time-limited approval | #1, #6, #20, #21 | Yes | Yes | Wrike Product Team | Pilot |
| CD1.3 | Named Primary & Secondary Ownership | #1, #9, #10 | Yes | Yes | Global Wrike Team + Business Owner | Pilot |
| CD1.4 | Owner Status Monitoring & Alerts | #1, #7 | Yes | Yes | Wrike Product Team + Global Wrike Team | Rollout |
| CD1.5 | Reactivation Approval | #1, #6, #11 | Yes | No | Wrike Product Team + Global Wrike Team | Rollout |
| CD1.6 | Agent Retirement Process | #1, #11 | Yes | No | Global Wrike Team | Rollout |
| CD1.7 | Agent Naming Standards & Templates | #11 | Yes | No | Global Wrike Team | Rollout |
Risks Covered
- #1 Governance & Accountability
- #6 Process & Approval Bypass
- #7 Monitoring & Visibility
- #9 Operational Support
- #10 Compliance & Regulatory
- #11 Agent Sprawl
- #20 Autonomous Actions
- #21 External AI Platform
CD2. Identity, Access & Security Controls#
Authenticate users, manage token lifecycle and constrain access to approved scope. · Slide 12
| ID | Capability | Risks Addressed | AI Agent | MCP | Owner | Required For |
|---|---|---|---|---|---|---|
| CD2.1 | Scoped MCP Tokens | #3, #15, #16 | No | Yes | Wrike Product Team | Pilot |
| CD2.2 | OAuth Authentication | #4, #17 | No | Yes | Wrike Product Team | Pilot |
| CD2.3 | Controlled Token Issuance | #4 | No | Yes | Wrike Product Team | Pilot |
| CD2.4 | Token Rotation, Expiry & Time-Bounded Access | #4 | No | Yes | Wrike Product Team + Global Wrike Team | Pilot |
| CD2.5 | Token Inventory | #4, #7 | No | Yes | Wrike Product Team + Global Wrike Team | Rollout |
| CD2.6 | No Shared Credentials | #3, #17 | No | Yes | Global Wrike Team | Pilot |
| CD2.7 | User Context Enforcement | #17 | No | Yes | Wrike Product Team + Global Wrike Team | Pilot |
| CD2.8 | Access Recertification Reporting | #3 | Yes | Yes | Wrike Product Team + Global Wrike Team | Rollout |
Risks Covered
- #3 Permissions & Identity
- #4 MCP Security
- #7 Monitoring & Visibility
- #15 Tool Misuse
- #16 Cross-System Data Leakage
- #17 Identity Propagation
CD3. Action Governance & Data Protection#
Prevent large-scale extraction, corruption and bypass of protected controls. · Slide 13
| ID | Capability | Risks Addressed | AI Agent | MCP | Owner | Required For |
|---|---|---|---|---|---|---|
| CD3.1 | Bulk Update & Extraction Limits | #2, #6, #16, #20 | Yes | Yes | Wrike Product Team | Pilot |
| CD3.2 | Record-Return & Rate Limits | #2, #16, #20 | Yes | Yes | Wrike Product Team | Pilot |
| CD3.3 | Time-Bounded, Scoped and Volume-Bounded Approval | #2, #6, #20 | Yes | Yes | Wrike Product Team | Pilot |
| CD3.4 | High-Risk Action Approval Gates | #6, #20 | Yes | Yes | Wrike Product Team | Pilot |
| CD3.5 | Access & Approval-Rule Protection | #3, #6, #20 | Yes | Yes | Wrike Product Team | Pilot |
| CD3.6 | Preview Impacted Records | #2, #20 | Yes | Yes | Wrike Product Team | Pilot |
| CD3.7 | Read-Only Agent Mode | #15, #18, #20 | Yes | Yes | Wrike Product Team | Rollout |
| CD3.8 | Protected Fields | #2, #20 | Yes | Yes | Wrike Product Team | Rollout |
| CD3.9 | Rollback Capability | #2, #20 | Yes | Yes | Wrike Product Team | Rollout |
Risks Covered
- #2 Data Exposure & Scale
- #3 Permissions & Identity
- #6 Process & Approval Bypass
- #15 Tool Misuse
- #16 Cross-System Data Leakage
- #18 Prompt Injection
- #20 Autonomous Actions
CD4. Audit, Compliance & Traceability#
Evidence the requester, agent, MCP connection, executed action and resulting change. · Slide 14
| ID | Capability | Risks Addressed | AI Agent | MCP | Owner | Required For |
|---|---|---|---|---|---|---|
| CD4.1 | Immutable Audit Logging | #10, #12, #19 | Yes | Yes | Wrike Product Team | Pilot |
| CD4.2 | User vs Agent Attribution | #10, #12, #19 | Yes | Yes | Wrike Product Team | Pilot |
| CD4.3 | MCP Connection Details in Logs | #4, #19 | No | Yes | Wrike Product Team | Rollout |
| CD4.4 | Exportable Audit Records | #12, #19 | Yes | Yes | Wrike Product Team | GA |
| CD4.5 | Approval Expiry Evidence & Audit Retention Controls | #10, #12 | Yes | Yes | Wrike Product Team | GA |
| CD4.6 | Compliance Reporting | #10 | Yes | Yes | Global Wrike Team + Business Taskforce | GA |
Risks Covered
- #4 MCP Security
- #10 Compliance & Regulatory
- #12 Audit & Assurance
- #19 Lack of Traceability
CD5. AI Safety & Trust Controls#
Reduce misleading outputs, malicious instructions and cross-system boundary breaches. · Slide 15
| ID | Capability | Risks Addressed | AI Agent | MCP | Owner | Required For |
|---|---|---|---|---|---|---|
| CD5.1 | Prompt Injection Protection | #18 | Yes | Yes | Wrike Product Team | Rollout |
| CD5.2 | Tool Restrictions | #15, #18 | No | Yes | Wrike Product Team | Pilot |
| CD5.3 | Tool-Level Permissions | #15, #16, #18 | No | Yes | Wrike Product Team | Rollout |
| CD5.4 | Source Attribution | #5 | Yes | Yes | Wrike Product Team | Rollout |
| CD5.5 | Confidence Indicators | #5 | Yes | Yes | Wrike Product Team | Rollout |
| CD5.6 | Validation Workflow | #5 | Yes | Yes | Wrike Product Team + Global Wrike Team | Rollout |
| CD5.7 | Data Boundary Enforcement | #16, #21 | No | Yes | Wrike Product Team + AI CoE + Global Wrike Team | Pilot |
| CD5.8 | Context-Sharing Restrictions | #16 | No | Yes | Wrike Product Team | Pilot |
Risks Covered
- #5 Accuracy & Hallucination
- #15 Tool Misuse
- #16 Cross-System Data Leakage
- #18 Prompt Injection
- #21 External AI Platform
CD6. Monitoring & Operational Controls#
Provide central visibility, rapid containment and clear support ownership. · Slide 16
| ID | Capability | Risks Addressed | AI Agent | MCP | Owner | Required For |
|---|---|---|---|---|---|---|
| CD6.1 | Enterprise Dashboard & Activity Feed | #7, #19 | Yes | Yes | Wrike Product Team | Rollout |
| CD6.2 | Ownership Reporting & Alerts | #1, #7 | Yes | Yes | Wrike Product Team | Rollout |
| CD6.3 | Approval Expiry & Abnormal Behaviour Alerts | #7, #18, #20 | Yes | Yes | Wrike Product Team | Rollout |
| CD6.4 | Support Model & SLA | #9 | Yes | Yes | Wrike Product Team + Global Wrike Team | GA |
| CD6.5 | Support Ownership Matrix | #9 | Yes | Yes | Wrike Product Team + Global Wrike Team | Rollout |
| CD6.6 | Incident Communications Framework | #14 | Yes | Yes | Global Wrike Team | Pilot |
| CD6.7 | Individual Agent Disablement | #9, #14, #15, #20 | Yes | Yes | Wrike Product Team | Pilot |
| CD6.8 | Central Agent Management | #7, #9, #11 | Yes | Yes | Wrike Product Team | Rollout |
Risks Covered
- #1 Governance & Accountability
- #7 Monitoring & Visibility
- #9 Operational Support
- #11 Agent Sprawl
- #14 Reputation & Client Trust
- #15 Tool Misuse
- #18 Prompt Injection
- #19 Lack of Traceability
- #20 Autonomous Actions
CD7. Commercial & Consumption Controls#
Make usage, thresholds, forecasts and cost ownership visible before wider adoption. · Slide 17
| ID | Capability | Risks Addressed | AI Agent | MCP | Owner | Required For |
|---|---|---|---|---|---|---|
| CD7.1 | Usage Quotas | #8 | Yes | Yes | Wrike Product Team | GA |
| CD7.2 | Cost Attribution | #8 | Yes | Yes | Wrike Product Team | GA |
| CD7.3 | Threshold Alerts | #8 | Yes | Yes | Wrike Product Team | GA |
| CD7.4 | Forecasting | #8 | Yes | Yes | Wrike Product Team | GA |
| CD7.5 | Consumption Reporting | #8 | Yes | Yes | Wrike Product Team + Global Wrike Team | GA |
Risks Covered
- #8 Token Consumption & Cost