Review one agent action
Agent Action Security Review
We try to break your AI agent before someone else does.
Engineering teams and AI implementation partners preparing to launch or hand over an agent.
You pick one action that matters — a refund, a record change, an access grant. We try to make your agent do it when it shouldn't, inside a boundary you sign off first. You get a record of what happened, the evidence, and what we'd fix. We might not get through. That's part of the result.
You pick one action that matters. We try to make your agent do it when it shouldn't, inside a boundary you sign off first. We might not get through. That's part of the result.
You keep the report and the evidence.
- A map of the action — from a message in, to a change that sticks
- What we tried, and what it actually did
- How to reproduce each result
- Findings, each tied to the evidence behind them
- What we'd fix first, in order
- What we couldn't see, or couldn't prove
- A written report, and a walkthrough of it
Full deliverables
- Action map
- Findings linked to evidence
- Test results and demonstrated impact
- Reproduction conditions
- Prioritised recommendations
- Documented unknowns
- Written report and readout
What this isn't.
- One consequential agent action in the agreed environment only; no whole-environment assurance.
- Written authorization, environment, permitted test actions, prohibited outcomes, stop conditions and recovery are agreed before testing. Authorization must be enforced before the system changes; the six stages describe coverage, not permission-check ordering.
- No production changes without separate explicit authorization. No destructive activity, persistence, unrelated data access, remediation implementation, continuous monitoring or safety certification. This is not a penetration test of the whole environment or a security guarantee.
- A retest can be included in the original agreement when its cases, window and allowance are specified. No default retest allowance is promised.
- Historical synthetic samples are not a full-review sample and do not change the agreed commercial terms. Existing agreements keep their accepted scope and fee.
What this is
- One bounded test Active adversarial testing of one named consequential agent action in an agreed environment.
- Written findings tied to evidence Each finding sits beside the evidence that supports it.
- Explicit unknowns What the evidence did not establish is named in writing.
- A report you keep The written report and evidence are handed over at readout.
What this isn’t
- Agreed test actions only We attempt prohibited outcomes only within the written test boundary.
- Production needs separate authority No production changes without separate explicit authorization.
- Not certification No badge, seal or claim that an agent is safe is issued.
- Not remediation or monitoring Recommendations are prioritised; fixing and continuous monitoring stay outside this review.
One consequential action, such as issuing a refund, changing a record or granting access. Active adversarial testing only within the agreed environment and test boundary. Authorization must be enforced before the system changes. No production changes without separate explicit authorization, remediation implementation, continuous monitoring or safety certification. This is not a penetration test of the whole environment.
The free hostname check stays a separate tool, not a second review.
We agree the scope first. The findings come with the evidence.
- Non-secret fit check Name the consequential action, systems involved, prohibited outcome and decision deadline. Do not send credentials, secrets or production data.
- Agreed scope and authority Agree the environment, input surfaces, identities, permitted test actions, stop conditions, recovery, evidence handling and recipients before testing. Confirm fee, delivery capacity, timing and any retest cases and allowance in the signed SOW.
- Active adversarial testing Attempt the agreed prohibited outcomes. Record the observable agent decision, submitted tools and parameters, validation, errors and retries. Check effective permissions and the authoritative backend for the actual saved change, including partial, duplicate or absent changes.
- Report and readout We don't test until you give written authority. Explain which controls resisted or failed, demonstrated impact, reproduction conditions, mitigation recommendations and gaps. Each case is failure demonstrated, resisted under tested conditions, inconclusive, or not tested. Explicit unknowns stay named. Your team owns remediation decisions.
Historical synthetic one-action example
What the record looks like.
- Consequential action
refund.issueabove a set amount, through a payments API — an illustrative action, not an executed one.One action per review. Chosen with you before evidence rules are agreed.- Executing identity
svc-agent-refunds@example.com— a reserved example of the identity an agent would run as, not the one that configured it.- Permission / authority boundary
- The roles, scopes and approval steps that stand between an identity and an action, as configured.Read from configuration under agreed evidence rules. Not assumed; none inspected here.
- Supporting evidence
- Policy exports, the tool manifest, approval configuration and action logs for an agreed window — each attached to the claim it supports.Collected only after evidence handling is agreed. No evidence was collected for this illustration.
- Finding
- A written statement of what an identity is permitted to do relative to an action, and what happens when it does it — with the evidence beside each claim.Written after review. This specimen carries no finding.
- Explicit unknowns
- What the evidence did not establish — for instance whether an action was exercised in the agreed window, or whether a human step exists outside the systems inspected.Named in writing. These are example questions, not results.
Illustrative. Reserved documentation names. No customer, execution, verification, authorisation failure or result is shown. This is the shape of a record, not a record.