Customizing the Risk Suggestion AI Agent

You may want to tailor the Risk Suggestion AI Agent to match your organization's messaging style, risk assessment process, or evaluation criteria. This guide covers the core customizations that most organizations make.

Quick Reference

Customization	Where to Make Changes
User Greeting and Cancellation Messages	Agent Instructions
In-Progress Messages When Tools Execute	Individual Tool Configurations
Customizing Risk Focus Domains	Agent Instructions
Adjusting Follow-Up Questions	Agent Instructions
Number of internal risks shown	Search Tool Script
Number of AI-inferred risks shown	NowAssist Skill Prompt
Number of external risks shown	Skill Prompt + Agent Instructions
Adjusting Similarity Thresholds	Individual Tool Configurations
Search profiles & indexing	AI Search Configuration
Entity fields sent to AI	Get Entity Information Tool Script
Disable external search	Agent Instructions

Messages and Conversational Flow

User Greeting and Cancellation Messages

Location: Agent Instructions

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

This will open the AI Agent Guided setup. The changes can be made under the "List of Steps" section defined for the agent.

What you can change:

Initial greeting — The message shown when the agent first starts
Entity display message — How entity attributes are presented to the user
Risk domain prompt — The question asking which types of risks to focus on
Completion message — The final message after triage records are created

Example 1: Customize the Initial Greeting

Out-of-the-box:

Hi! I'm here to help identify potential risks for this entity.

Your customization:

Let's assess the risks affecting this asset. I'll check your internal risk library,
look for industry patterns, and optionally search current public sources.

Example 2: Customize Risk Domain Options

Out-of-the-box:

Which types of risks should I look into? (For example: IT, data privacy, ESG,
third-party, compliance, operational)?

Your customization:

What's the primary concern for this asset? For example: Cybersecurity & data
protection, Financial & regulatory compliance, Supply chain dependencies, Business
continuity & resilience.

Example 3: Customize Completion Message

Out-of-the-box:

Great! The risk suggestion process is complete. A total of <N> risks were
identified and created in the triage table.

Your customization:

Done! I've created <N> triage risks for this asset. Your risk team can now
review and prioritize them from the Risk Triage table.

In-Progress Messages When Tools Execute

The agent has multiple tools that run during the risk identification process. Each tool displays status messages before and after execution to keep users informed.

Location: Individual Tool Configurations within the Agent Guided Setup

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Open the "Add Tools and Information" step. For each tool, access the Advanced settings to configure the In Progress and Completion Messages.

Current Out-of-the-Box Messages

Tool	In-Progress Message	Completion Message
Get Entity Information	Retrieving entity information	Entity information retrieved
Search relevant risk statements	I'm reviewing your organization's risk library to identify potential risks for this entity	Reviewed your risk library to identify potential risks
Suggest risks based on LLM Knowledge	Now analyzing industry patterns and broader knowledge to suggest additional risks	Analyzed industry patterns to identify additional risk suggestions
Search external risks	Searching current public sources for relevant risks...	Completed search of external sources
Transform external risks to JSON	(processes silently)	Extracted external risks
De-duplicate and categorize	Comparing all suggestions to eliminate duplicates...	Consolidated risk list, removing any duplicates
Create triage risk records	Creating triage risk records...	Triage risk records created successfully

Example: Make Messages More Conversational

Out-of-the-box in-progress message:

I'm reviewing your organization's risk library to identify potential risks for this entity

Your customization:

Searching your risk library for similar scenarios...

Out-of-the-box completion message:

Reviewed your risk library to identify potential risks

Your customization:

Found 7 matching risks from your library

Tip: Custom messages create a more personal experience but require maintenance if tool logic changes. Keep messages concise (under 100 characters when possible).

Customizing Risk Focus Domains

Location: Agent Instructions

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Replace the default prompt with your organization's risk categories in the "List of Steps" section.

Out-of-the-Box Domains

Which types of risks should I look into? (For example: IT, data privacy, ESG,
third-party, compliance, operational)

Example 1: Financial Services

Which risk areas matter most for this entity? (For example: Credit & market risk,
Regulatory & compliance, Operational & technology, Fraud & financial crime)

Example 2: Manufacturing

Which risks should we focus on? (For example: Supply chain disruption, Workplace
safety & compliance, Quality & product liability, Environmental & sustainability)

Adjusting Follow-Up Questions

Location: Agent Instructions

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

The agent asks at most two questions before showing risks:

One about risk focus (which domains matter)
Optionally, one follow-up if important context is missing

You can customize what information gaps trigger a follow-up question.

Default Behavior

The agent is instructed to ask about information gaps in: purpose, sensitivity, dependencies, change, regulation, etc.

Step 2.2 (out-of-the-box):

Using the entity context and selected risk domains from step 2.1, ask up to one
targeted question with focus on information gaps in purpose, sensitivity,
dependencies, change, regulation, etc.

Example 1: Compliance-Focused

Is this entity subject to SOC 2, PCI-DSS, or other specific compliance
frameworks I should consider?

Example 2: Operational-Focused

How many people or critical processes depend on this entity's availability?

Tip: Fewer follow-up questions speed up the workflow but may miss important context. More questions gather better information but can frustrate users. Ask only about gaps that actually change risk recommendations.

Controlling the Number of Suggestions

The agent retrieves suggestions from three sources: your internal library, AI reasoning, and external sources. You can control how many risks from each source appear.

Number of Internal Risks

Location: Search Tool Script in Agent Guided Setup

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Open the "Add Tools and Information" step and select the "Search Relevant Risk Statements" tool.

Out-of-the-Box Configuration

The default value searches for up to 8 internal risks :

var api = new sn_search.RAGRetrievalAPI(); var request = new sn_search.RAGRetrievalRequest() .searchProfile("sn_grc_sharegenai_leaf_risk_statements") .limit( 8 ) // ← Update this value .sortField('.semantic_similarity') .query(inputs['entityContext']);

How to customize

Change the .limit() value to adjust how many internal risks are retrieved:

Limit	Result	When to Use
3-5	Focused results; faster response	Risk library is large or duplicate-heavy
8 (default)	Balanced mix of options and speed	Most organizations
15-20	Comprehensive results; more alternatives	Risk library is smaller or highly specialized

Number of Model-Inferred Risks

Location: NowAssist Skill Prompt

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Open the "Add Tools and Information" step and select the "Generate model-inferred risks" tool. Click Preview to open the skill in Now Assist Skill Kit and update the prompt.

Note: Update the prompt for each LLM provider supported by your instance (Azure OpenAI, AWS Claude, Google Gemini, etc.).

How to Customize

Look for instructions in the prompt about how many risks to generate:

Range	Result	When to Use
2-3	Focused AI insights; fewer duplicates	Your library is comprehensive
3-8 (default)	Balanced set of AI suggestions	Most organizations
8-12	Extensive AI reasoning; more coverage	You rely heavily on AI inference

Change the range from 3-8 to your preferred value (e.g., 2-3 or 8-12).

Number of External Risks

Location: Agent Instructions + NowAssist Skill Prompt

External risks are configured in two stages :

Agent Instructions — Controls whether external search runs
Skill Prompt — Controls how many risks are extracted from web results

Step 1: Configure External Search in Agent Instructions

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Out-of-the-box Step 6.3:

If the user answers Yes, search external sources to generate 3 - 8 potential risks
from highly similar entities.

Customize the range:

If the user answers Yes, search external sources to generate 3-5 potential risks

If the user answers Yes, search external sources to generate 5-10 potential risks

Step 2: Configure the Extraction Skill Prompt

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Open the "Add Tools and Information" step and select the "Transform external risks in JSON format" tool. Click Preview to open the skill in Now Assist Skill Kit.

Out-of-the-box prompt includes:

### Rules
- Preserve all distinct risk themes mentioned
- If multiple risks are listed under one section, treat them as separate risks
  if described separately
- Only return 3-8 risks
- Do not include external knowledge

Customize the risk count:

- Only return 3-5 risks (for fewer)

- Only return 8-12 risks (for more)

Note: Keep the rule "Only return X risks" consistent across your agent instructions and skill prompt.

Tip: Showing more suggestions gives users options but can slow response time. Fewer risks keep the workflow focused but may miss emerging threats. Test with your actual external sources to find the right balance.

Adjusting Similarity Thresholds

The agent uses similarity thresholds at four different points in the risk identification workflow:

When searching your internal library for matching risks (retrieval)
When assigning categories to suggested risks
When deduplicating suggestions (comparing against existing risks)
When matching triage risks to existing risk statement definitions

These thresholds are intentionally different with deliberate gaps between them.

Retrieval Threshold for Internal Search

Location: Search Tool Script in Agent Guided Setup

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Open the "Add Tools and Information" step and select the "Search Relevant Risk Statements" tool.

Out-of-the-Box Configuration

The default retrieval threshold is 0.7 (70% similarity):

request.semanticConfiguration(new sn_search.RAGRetrievalSemanticConfiguration() .documentMatchThreshold(0.7) // ← This value controls retrieval threshold .embeddingModelId('E5FT') .mode('KEYWORD') .semanticIndexNames(['Words']) );

How to customize

Change the .documentMatchThreshold() value:

Threshold	Result	When to Use
0.6	Many suggestions; some tangentially related	Your library is sparse or specialized
0.7 (default)	Balanced; catches relevant risks without noise	Most organizations
0.8+	Only highly similar risks; fewer results	Your library is large and well-organized

Example:

.documentMatchThreshold(0.6) // More permissive

Why this matters: A lower threshold (0.6) casts a wide net and finds more potential matches. A higher threshold (0.8) is stricter and returns only close matches. The difference is noticeable when entity descriptions are ambiguous.

Deduplication Threshold: Comparing Against Existing Risks

Location: Deduplication Tool Script in Agent Guided Setup

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Open the "Add Tools and Information" step and select the "De-duplicate and categorize suggested risks" tool.

Out-of-the-Box Configuration

The default deduplication threshold is 0.8 (80% similarity):

Function: ragSearchToFindSimilarRiskRecord()

function ragSearchToFindSimilarRiskRecord(suggestedRisk, searchProfile, sourceTable, filterQuery, semanticIndexNamesParam) { var api = new sn_search.RAGRetrievalAPI(); var request = new sn_search.RAGRetrievalRequest() .searchProfile(searchProfile) .limit(1) .sortField('.semantic_similarity') .query("Find risks similar to " + suggestedRisk['risk_name']); request.semanticConfiguration(new sn_search.RAGRetrievalSemanticConfiguration() .documentMatchThreshold(0.8) // ← This value controls dedup threshold .embeddingModelId('E5FT') .mode('KEYWORD') .semanticIndexNames([semanticIndexNamesParam]) ); // ... rest of function }

How to customize

Change the .documentMatchThreshold() value in the deduplication function:

Threshold	Result	When to Use
0.70-0.75	Aggressive deduplication; many risks marked as duplicates	You want minimal redundancy
0.80 (default)	Conservative deduplication; only highly similar risks removed	You want to avoid hiding related-but-distinct risks
0.85+	Very strict; only near-identical risks marked as duplicates	Your risk taxonomy is very granular

Example:

.documentMatchThreshold(0.75) // More aggressive deduplication

Category Association Threshold

Location: Deduplication Tool Script in Agent Guided Setup

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Open the "Add Tools and Information" step and select the "De-duplicate and categorize suggested risks" tool.

Out-of-the-Box Configuration

The default category association threshold is 0.7 (70% similarity):

Function: ragSearchToFindSimilarCategory()

function ragSearchToFindSimilarCategory(suggestedRisk, searchProfile, sourceTable, semanticIndexNamesParam) { var api = new sn_search.RAGRetrievalAPI(); var request = new sn_search.RAGRetrievalRequest() .searchProfile(searchProfile) .limit(1) .sortField('.semantic_similarity') .query("Find category for " + suggestedRisk['risk_name']); request.semanticConfiguration(new sn_search.RAGRetrievalSemanticConfiguration() .documentMatchThreshold(0.7) // ← This value controls category threshold .embeddingModelId('E5FT') .mode('KEYWORD') .semanticIndexNames([semanticIndexNamesParam]) ); // ... rest of function }

How to Customize:

`Change the .documentMatchThreshold()` value in the category matching function:

Threshold	Result	When to Use
0.60-0.65	Broad category matching; more risks auto-assigned	Library has few categories
0.70 (default)	Balanced; most risks get assigned to categories	Most organizations
0.75-0.80	Strict category matching; some risks left uncategorized	Many narrow, specialized categories
0.85+	Very strict; only near-perfect matches categorized	Highly granular category structure

Risk Statement Matching Threshold

Location: Suggest Risk Statement Business Rule Script

Navigate to:

All → System Definition → Business Rules

Search for and open: "Suggest risk statement" (or filter by table: sn_risk_risk_triage)

Out-of-the-Box Configuration

The default risk statement matching threshold is 0.85 (85% similarity):

Function: getSimilarRiskStatement() (called from the "Suggest risk statement" business rule)

function getSimilarRiskStatement() {
  try {
    var api = new sn_search.RAGRetrievalAPI();
    var request = new sn_search.RAGRetrievalRequest()
      .searchProfile("sn_grc_sharegenai_risk_statements")
      .limit(1)
      .sortField('.semantic_similarity')
      .query(current.name + " , " + current.description);

    request.semanticConfiguration(
      new sn_search.RAGRetrievalSemanticConfiguration()
      .documentMatchThreshold(0.85) // ← This value controls risk statement matching
      .embeddingModelId('E5FT')
      .mode('KEYWORD')
      .semanticIndexNames(['Words'])
    );

    var response = api.retrieve(request);
    // ... rest of function
  } catch (error) {
    gs.error('RiskStatementEnrichmentTool failed: ' + error);
  }
}

This threshold is used when triage risks are created to match them against existing risk statement definitions in your library.

How to Customize

Change the .documentMatchThreshold() value:

Threshold	Result	When to Use
0.75-0.80	Liberal matching; many risks linked to statements	Risk library is large; want high coverage
0.85 (default)	Balanced matching; strict but not too strict	Most organizations
0.90+	Conservative matching; only near-identical risks linked	Risk library is small; want high precision

The Intentional Gaps

Notice the deliberate spacing between thresholds:

Stage	Threshold	Purpose
Retrieval	0.7	Cast wide net to discover candidates
Category	0.7	Flexible category assignment
Deduplication	0.8	Conservative dedup, avoid hiding different risks
Risk Statement	0.85	Strict matching for triage enrichment

Why these gaps matter:

Retrieval at 0.7 — Finds more candidate risks to present to users
Category at 0.7 — Doesn't restrict risk suggestions based on category availability
Dedup at 0.8 — Avoids over-deduplicating related-but-distinct risks
Risk Statement at 0.85 — Only links triage risks to statements when highly confident

Search Profiles and Indexing

The agent searches across multiple semantic indexes to find risks, categories, and matches:

Profile	Searches	Used For
Leaf Risk Statements	sn_risk_definition (leaf-level only)	Internal risk retrieval
Risks	sn_risk_risk	Deduplication vs linked risks
Triage Risks	sn_risk_risk_triage	Deduplication vs existing triage
GRC Categories	sn_grc_choice	Auto-assign risk categories

Customize Which Records Get Indexed

Navigate to:

All → AI Search → Search Profiles → Open profile

Edit the indexed search source's condition field to limit what's indexed:

Example 1: Only Index Active Risk Definitions

Filter: Active = true
        AND Status != "Archived"

Example 2: Exclude Certain High-Level Risks

Filter: Risk Level = "Leaf Level"
        AND NOT (Category = "Meta-Risk")

These filters prevent inactive, archived, or non-leaf risks from being included in internal searches.

Configuring Entity Fields Sent to AI

Location: Get Entity Information Tool Script

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Open the "Add Tools and Information" step and select the "Get Entity Information" tool.

Out-of-the-Box Configuration

By default, the agent retrieves and sends these entity attributes to the AI for risk analysis:

Name
Description
Class
Location
Department

How to Customize

You can add custom fields or remove sensitive fields from the entity context sent to the AI.

Steps:

Open the Get Entity Information tool script
Find the section where entityInfo is built
Add or remove fields from the object

Example: Add Custom Fields and Remove Sensitive Fields

// Get entity attributes var gr = new GlideRecordSecure('sn_grc_profile'); gr.get(entityId); if (gr) { var entityInfo = {}; entityInfo["name"] = gr.getDisplayValue('name'); entityInfo['department'] = gr.cmn_department.getDisplayValue(); //entityInfo['location'] = gr.cmn_location.getDisplayValue(); //Removing sensitive location field entityInfo['description'] = gr.description.getDisplayValue(); entityInfo['class'] = gr.profile_class.getDisplayValue(); entityInfo['owner'] = gr.owner.getDisplayValue(); //Adding custom owner field entityInfo['criticality'] = gr.criticality.getDisplayValue(); //Adding custom criticality field result["entityInfo"] = entityInfo; }

Recommendations

Only include fields that are relevant to risk assessment
Exclude PII or sensitive data (credentials, internal IPs, financial details)
Ensure custom fields are populated for most entities

Disabling External Search

Locations:

Agent Instructions
Tool Configurations (in "Add Tools and Information" step)

Navigate to:

All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"

Out-of-the-Box Behavior

By default, the agent asks users if they want to search external sources (web, regulatory databases, etc.) for additional risks. If yes, it calls external search and transforms the results before deduplication.

How to Customize: Completely Disable External Search

Navigate to: All → AI Agents → My Solutions → AI Agents → "Risk Suggestion AI Agent"
Scroll to "List of Steps" section in the guided setup
Find and DELETE the entire Step 6 which requests User permission for conducting external search
Find and DELETE the entire Step 7 which displays the extracted external risks.
RENUMBER all remaining steps after deletion.

Important: Testing and Customization Best Practices

Before You Deploy

Before deploying any customization to production:

Test in a sub-production instance using real assets from your organization
Test edge cases — sparse entities, unusual risk domains, incomplete descriptions
Verify end-to-end flow — from agent start through triage record creation.
Check message clarity — verify messages display correctly and match your org's style.
Validate threshold adjustments — check which risks appear and which are filtered.
Keep clear records of each customization for future reference and upgrade management.