Risk register
| Risk | Impact | Mitigation and evidence |
|---|---|---|
| Rural WebRTC instability | Abandoned consultation | Network survey, TURN, adaptation ladder, reconnect and queued fallback. |
| Excessive video inference | Latency and unsustainable cost | Adaptive selected-frame policy, budgets and cost dashboards. |
| Stale or irrelevant frame | Incorrect visual reasoning | Timestamp/objective provenance, scene-change detection and explicit usable-vision state. |
| Poor camera guidance | Insufficient evidence | One instruction at a time, quality feedback, farmer UX testing. |
| Unauthorized room join | Privacy breach | Short-lived role tokens, notifications, audit and penetration tests. |
| Unintended full-call recording | Privacy/legal harm | Recording off by default, visible state, separate consent and policy tests. |
| Poor Urdu critical-entity transcription | Wrong crop/chemical/number/place | Benchmark, vocabulary, confirmation and error dashboard. |
| Similar-looking conditions | Incorrect diagnosis | Multiple guided views, differential analysis, context and escalation. |
| Model overconfidence | Premature answer | Evidence sufficiency, counter-hypothesis review and risk verification. |
| Hallucinated source/fact | Unsupported advice | Identifier resolution, passage citation and output validation. |
| Outdated local guidance | Unsafe or illegal action | Effective dates, approval, withdrawal and impacted-case analysis. |
| Web-source poisoning/prompt injection | Bad research or control compromise | Authority scoring, isolation, typed tools and red-team tests. |
| Exact treatment without authorization | Farmer harm/regulatory breach | Deterministic policy verification and fail-closed behaviour. |
| Officer overload | Delayed joins/reviews | Capacity model, risk queue, SLA alerts and scope control. |
| Sensitive geospatial exposure | Privacy/commercial harm | Minimization, access controls, audit and export limits. |
| Provider outage/deprecation | Service loss | Gateway, fallback, version pinning, reconnect/queue and exit terms. |
| Inadequate evaluation data | False confidence | Consent-based stratified live-call datasets and shadow mode. |
| Farmer overtrust | Harm or delayed expert care | Uncertainty language, scope education, escalation and follow-up. |
Risk governance
Every material risk has an owner, current/target rating, leading indicator, mitigation deadline and contingency. Review weekly during build and daily for critical pilot risks. Residual high-risk acceptance requires named departmental authority.