Open items tracker
Each row is one bullet from the control pages, in the deck's wording, linked back to its source section. The Owner and Status columns are the working part: fill them in during discussion and keep them current. Only the Owner column on the readiness table starts filled, with the party named in the deck.
Status values: Open · In discussion · Evidence received · Agreed · Closed · Won't do. New rows start as Open; owners start as TBD.
Counts: 2 gaps · 22 confirm · 25 pilot · 10 pilot readiness
Gaps#
Known shortfalls with no current control. Decide whether to accept the residual risk or find a mitigation.
| ID | Risk | Applies to | Item | Owner | Status | Source |
|---|---|---|---|---|---|---|
G-01 | #20 Autonomous Actions | AI Agents | A small location reduces exposure, but it is not an enforced record-count or request-rate cap. | TBD | Open | Data scope, s10–11 |
G-02 | #6 Process & Approval Bypass | AI Agents | Wrike does not provide a native workflow that routes AI Agent activation to an approver. | TBD | Open | Human review, s12–13 |
Confirm: evidence and setup to be shown#
Items WPP or Wrike must check, demonstrate or test before the Pilot relies on the control.
| ID | Risk | Applies to | Item | Owner | Status | Source |
|---|---|---|---|---|---|---|
C-01 | #7 Monitoring & Visibility | MCP | Check what activity the middleware actually makes visible. | TBD | Open | Ownership, s3–4 |
C-02 | #6 Process & Approval Bypass | MCP | Check which write actions the assistant asks a person to approve, and which actions WPP's middleware blocks or allows. | TBD | Open | Review & oversight, s5–7 |
C-03 | #20 Autonomous Actions | MCP | Test a high-impact write in the chosen assistant to confirm LLM client controls | TBD | Open | Review & oversight, s5–7 |
C-04 | #3 Permissions & Identity · #15 Tool Misuse | MCP | Check that middleware scope and assistant tool settings keep access within the approved use case. | TBD | Open | Identity, s8 |
C-05 | #4 MCP Security | MCP | WPP shows how its setup issues, expires, rotates and revokes the tokens used for MCP access. | TBD | Open | Identity, s8 |
C-06 | #17 Identity Propagation | MCP | Check whose identity reaches Wrike, what access is delegated and that shared accounts are avoided. | TBD | Open | Identity, s8 |
C-07 | #3 Permissions & Identity | MCP | Agree the approved client IDs and configure them with Support. | TBD | Open | MCP connections, s9 |
C-08 | #4 MCP Security: integration connects to the wrong account | MCP | Set the approved corporate accounts and check the supported OAuth flow with Support. | TBD | Open | MCP connections, s9 |
C-09 | #2 Data Exposure & Scale | MCP | Show which data the middleware lets MCP read or change, how much it can return, and whether bulk operations have enforced limits. Confirm WPP LLM client and/or MCP gateway can control which tools can be used. | TBD | Open | Data scope, s10–11 |
C-10 | #3 Permissions & Identity · #6 Process & Approval Bypass | MCP | Test the user's Wrike access, the assistant's allowed tools and middleware restrictions together, including an action that should be denied. | TBD | Open | Data scope, s10–11 |
C-11 | #20 Autonomous Actions | MCP | MCP gateway behaves as expected in terms of action limits. | TBD | Open | Data scope, s10–11 |
C-12 | #6 Process & Approval Bypass | MCP | WPP LLM client offers enforceable approval capability when human approval is required and which write operations are available. | TBD | Open | Human review, s12–13 |
C-13 | #20 Autonomous Actions | MCP | High-impact write tools require the intended human approval. | TBD | Open | Human review, s12–13 |
C-14 | #2 Data Exposure & Scale | MCP | A reviewer can check affected records and the approved time, scope and volume. | TBD | Open | Human review, s12–13 |
C-15 | #10 Compliance & Regulatory | MCP | Identify the evidence available for MCP activity. | TBD | Open | Audit, s14–15 |
C-16 | #12 Audit & Assurance | AI Agents | Check how long records are kept and how they are protected against alteration. | TBD | Open | Audit, s14–15 |
C-17 | #19 Lack of Traceability | AI Agents | Use a real log example to identify the agent, its action and the resulting change, rather than relying only on a description of logging. | TBD | Open | Audit, s14–15 |
C-18 | #19 Lack of Traceability | MCP | Follow one real request from its originating user through the MCP call to the resulting Wrike change, and identify the evidence at each step. | TBD | Open | Audit, s14–15 |
C-19 | #15 Tool Misuse | MCP | Turn off unapproved tools in the LLM assistant / MCP gateway, then test both an allowed action and an action the Pilot should prevent. | TBD | Open | Tools & boundaries, s16 |
C-20 | #18 Prompt Injection | MCP | Test whether malicious instructions can trigger an unapproved action or data disclosure. | TBD | Open | Tools & boundaries, s16 |
C-21 | #16 Cross-System Data Leakage · #21 External AI Platform | MCP | Gateway restricts connections and data access; assistant policies control shared context. Test the handling of sensitive cross-system information. | TBD | Open | Tools & boundaries, s16 |
C-22 | #9 Operational Support | MCP | how to stop the assistant or middleware connection and revoke access tokens. Name an operator who can carry out those steps. | TBD | Open | Incident response, s17 |
Pilot: proposed WPP processes and controls#
Processes WPP proposes to run during the Pilot. Each needs an owner and an agreed way of working.
| ID | Risk | Applies to | Item | Owner | Status | Source |
|---|---|---|---|---|---|---|
P-01 | #1 Governance & Accountability | AI Agents | WPP assigns a named owner to every Pilot agent. | TBD | Open | Ownership, s3–4 |
P-02 | #1 Governance & Accountability | MCP | WPP keeps a list of approved MCP connections and their owners, so each integration has someone responsible for its setup and use. | TBD | Open | Ownership, s3–4 |
P-03 | #7 Monitoring & Visibility | AI Agents | WPP manually reviews the Pilot inventory and activity. | TBD | Open | Ownership, s3–4 |
P-04 | #7 Monitoring & Visibility | MCP | WPP tracks which MCP connections are in use and reviews their activity. | TBD | Open | Ownership, s3–4 |
P-05 | #11 Agent Sprawl | AI Agents | Review that list for duplicates and agents that no longer have a clear purpose or owner. | TBD | Open | Ownership, s3–4 |
P-06 | #6 Process & Approval Bypass | AI Agents | WPP's Taskforce reviews the proposed use case before the agent is activated. | TBD | Open | Review & oversight, s5–7 |
P-07 | #21 External AI Platform | MCP | WPP approves the external platform, connection design and data scope before use, then records each approved connection and its owner. | TBD | Open | Review & oversight, s5–7 |
P-08 | #3 Permissions & Identity · #15 Tool Misuse | AI Agents | Give creation rights only to approved Pilot builders. | TBD | Open | Identity, s8 |
P-09 | #2 Data Exposure & Scale | AI Agents | WPP approves those locations and checks how much data and work they contain. | TBD | Open | Data scope, s10–11 |
P-10 | #3 Permissions & Identity · #6 Process & Approval Bypass | AI Agents | Review the agent's configured actions before it is used in an approved location. | TBD | Open | Data scope, s10–11 |
P-11 | #20 Autonomous Actions | AI Agents | Start with approved locations and use cases. | TBD | Open | Data scope, s10–11 |
P-12 | #6 Process & Approval Bypass | AI Agents | WPP's Taskforce reviews the use case before AI Agent activation. | TBD | Open | Human review, s12–13 |
P-13 | #20 Autonomous Actions | AI Agents | Review the agent's configured actions and possible impact upfront. | TBD | Open | Human review, s12–13 |
P-14 | #2 Data Exposure & Scale | AI Agents | Keep actions within the agreed scope and exclude operations needing an unavailable preview. Wrike offers agent sandbox for testing agents before running them. | TBD | Open | Human review, s12–13 |
P-15 | #10 Compliance & Regulatory | AI Agents | Keep the Taskforce's approval record and evidence of the controls agreed for each use case. | TBD | Open | Audit, s14–15 |
P-16 | #10 Compliance & Regulatory | MCP | Check the use case against client and contractual restrictions, and retain the approval. | TBD | Open | Audit, s14–15 |
P-17 | #15 Tool Misuse | AI Agents | Review that setup against the approved use case. | TBD | Open | Tools & boundaries, s16 |
P-18 | #18 Prompt Injection | AI Agents | AI Agents instructions are defined during creation and malicious instructions can't be injected. Wrike also uses Prompt Shield API from Microsoft to prevent any system-lvl malicious instructions. | TBD | Open | Tools & boundaries, s16 |
P-19 | #18 Prompt Injection | MCP | Limit tools and high-impact writes. | TBD | Open | Tools & boundaries, s16 |
P-20 | #16 Cross-System Data Leakage · #21 External AI Platform | AI Agents | Keep native-agent work in approved Wrike locations, and review which data is present there before enabling the agent. | TBD | Open | Tools & boundaries, s16 |
P-21 | #9 Operational Support | AI Agents | Name the person who can disable it and the person responsible for recovery. | TBD | Open | Incident response, s17 |
P-22 | #14 Reputation & Client Trust | AI Agents | Agree who investigates, escalates, restores service and communicates with WPP if an agent causes an incident. | TBD | Open | Incident response, s17 |
P-23 | #14 Reputation & Client Trust | MCP | Agree how teams coordinate an incident spanning the assistant, middleware and Wrike, including who updates WPP and any affected stakeholders. | TBD | Open | Incident response, s17 |
P-24 | #20 Autonomous Actions | AI Agents | Taskforce reviews the AI Agents performance and details what/if any further in-product requirements they have for Wrike. | TBD | Open | Incident response, s17 |
P-25 | #20 Autonomous Actions | MCP | Taskforce reviews the actions done via MCP and its performance and details what/if any further in-product requirements they have for Wrike. | TBD | Open | Incident response, s17 |
Pilot readiness: responsibilities#
From the readiness slide. The owner column starts with the party named in the deck.
| ID | Risk | Applies to | Item | Owner | Status | Source |
|---|---|---|---|---|---|---|
R-01 | Governance & oversight (#1, #6, #7, #11, #20) | AI Agents | Demonstrate the registry, creation rights and protected rules. | Wrike | Open | Readiness, s18 |
R-02 | Governance & oversight (#1, #6, #7, #11, #20) | AI Agents | Agree named owners, use-case review and treatment of high-impact actions. | Joint | Open | Readiness, s18 |
R-03 | Governance & oversight (#1, #6, #7, #11, #20) | MCP | Record connections and owners. | WPP | Open | Readiness, s18 |
R-04 | Governance & oversight (#1, #6, #7, #11, #20) | MCP | Agree which client approval settings and middleware restrictions apply to high-risk writes. | Joint | Open | Readiness, s18 |
R-05 | Identity, data & tool boundaries (#2, #3, #4, #15–#18, #21) | AI Agents | Show the actions and locations configured for Pilot agents. | Wrike | Open | Readiness, s18 |
R-06 | Identity, data & tool boundaries (#2, #3, #4, #15–#18, #21) | AI Agents | Check the data present and agree the acceptable exposure for the Pilot. | Joint | Open | Readiness, s18 |
R-07 | Identity, data & tool boundaries (#2, #3, #4, #15–#18, #21) | MCP | Demonstrate OAuth, allowlists, token handling, permitted tools and middleware scope, including how the assistant handles shared context. | WPP | Open | Readiness, s18 |
R-08 | Audit, support & client trust (#9, #10, #12, #14, #19) | AI Agents | Show real logs, agent attribution and disablement. | Wrike | Open | Readiness, s18 |
R-09 | Audit, support & client trust (#9, #10, #12, #14, #19) | AI Agents | Confirm the evidence WPP needs and who owns incident response and recovery. | Joint | Open | Readiness, s18 |
R-10 | Audit, support & client trust (#9, #10, #12, #14, #19) | MCP | Trace a real MCP action, rehearse shutdown and token revocation, and agree which team owns audit evidence and incident communications. | Joint | Open | Readiness, s18 |
Discussion log#
| Date | Topic | Decision / outcome | Owner |
|---|---|---|---|