A risky agent is one whose behavior—especially the data it generates or accesses—indicates a higher likelihood of sensitive data exposure or policy violations. IRM determines this by analyzing signals from agent activity (e.g., responses, data access, sharing) against policy-defined indicators and behavioral baselines, then aggregating those signals into a risk score and assigning a risk level to the agent.