In Functional Safety engineering there is a phase called "Hazard and Risk" where the unwanted adverse events are identified (as best possible) and recorded with

In Functional Safety engineering there is a phase called "Hazard and Risk" where the unwanted adverse events are identified (as best possible) and recorded with downstream traceability to ensure they are addressed. Tools used are HAZOP/HAZID/CHAZOP/What If etc, tailored to the situation. Facilitating such an event is a specialised and acquired skill. However, the process is usually waterfall, because if you are fully agile and don't really have any idea exactly what you are building before you start, you either need to do this Hazard and Risk as a refresh at every architectural or functional pivot, or more detailed definition of any kind (unlikely), or just wing it and hope...