Review workflow

The current paid review is Agent Action Security Review with a fixed fee, agreed in a signed SOW before we start. It actively tests one consequential AI-agent action across attacker-controlled input, the observable agent decision, tool or API call, effective permissions, actual saved change and supporting evidence. We don't test until you give written authority.

1. Send a non-secret fit check

Describe the one action you want reviewed, the systems involved, and your decision deadline in the request form. Do not send files, logs, screenshots, customer evidence, credentials, private keys, API keys, session tokens, recovery codes or other secrets. An enquiry and mailbox confirmation establish contact only; neither books work nor authorises a review.

2. Agree scope and authority

Before testing, agree the environment, action, input surfaces, identities, permitted operations, prohibited outcomes, attempt and side-effect limits, stop conditions, saved baseline and recovery. Confirm written authority for affected resources, evidence sources, handling, recipients, fee and timing in the signed statement of work. Arrange any limited test access separately through the agreed secure method. Required inputs, payment and operator capacity must also be confirmed. Only approved test data and sanitized evidence may be shared after authority, scope and secure handling are agreed. No expanded fixed price, delivery capacity or default retest allowance is promised; resolve them before accepting work. A new action or wider workflow needs its own scope decision.

3. Actively test the complete action path

WitnessOps attempts the agreed prohibited outcomes. We record the input surface, observable agent decision, submitted tool or API calls and parameters, validation, errors and retries, acting identity, effective permissions and approval boundaries. We read back the authoritative backend to establish actual saved changes, including partial, duplicate or absent changes. A tool success message alone is insufficient.

Authorization must be enforced before the system changes. The six stages describe coverage, not permission-check ordering. Findings cite their evidence; unavailable or inconclusive material remains an explicit gap. If authority, an agreed limit or a stop condition fails, work stops until the boundary is resolved.

4. Receive the report and readout

The handover includes an action map, test results, demonstrated impact, reproduction conditions, mitigation recommendations, explicit gaps, a written report and a readout. Each case is failure demonstrated, resisted under tested conditions, inconclusive, or not tested. Missing evidence is not a pass, and a resisted case does not establish safety beyond the tested conditions. Your team owns remediation. A retest can be included in the original agreement when its cases, window and allowance are specified.

Production changes require separate explicit authorization. Destructive activity, persistence, unrelated data access, remediation implementation, continuous monitoring and safety certification are excluded. It does not promise a full device inventory, cryptographic receipt or offline verifier as a standard deliverable. It is not a penetration test of the whole environment or a security guarantee. Earlier agreements retain their accepted scope, fee, exclusions and retest terms; the expanded scope does not silently enlarge a previous read-only review or inherit its price.

Historical External Attack Surface Review

External Attack Surface Review is no longer available for new engagements. Issued agreements retain their original terms, including any agreed retest. Its public-facing-system checks and conditional receipt-profile package are historical terms; they do not describe or expand the Agent Action Security Review.

The legacy-named public_exposure_review profile remains a separate receipt-only compatibility path. Public receipt checks remain indeterminate when the underlying authority, workflow, artifact bytes, evidence and production trust have not been independently checked. That path does not add a receipt or verifier to the current review's standard deliverables.

For the full request sequence, read the Buyer path. To enquire about the current review, use the non-secret fit check.