Scope record
An agreed scope, configuration record, and list of exclusions.
One agent
Agent audits
Review one agent's behavior in agreed everyday and difficult cases.
Planned service · Inquiries open · Scope and availability agreed together.
What this helps with
We record the exact instructions, memory, tools, permissions, and model version that are in scope, then agree what should happen in ordinary and adverse cases. The result is a snapshot of tested cases, not a claim about every future interaction.
Good fit
An accountable owner has one defined use case and needs evidence about a concrete behavior. For organization-wide governance, see corporate assurance.
What you get
Test and trace manifest
A test and trace manifest that identifies the reviewed configuration.
Evidence-linked findings
Findings linked to evidence, with your team’s decisions and priorities.
Repair and retest plan
A repair and retest plan with coverage, reproduction, and retest definitions where measured.
How it works
- Agree: Set scope, exclusions, pass or fail conditions, and freeze the reviewed configuration.
- Exercise: Run agreed everyday and adverse cases with repeatable grading and trace capture.
- Resolve: Record findings, owner decisions, remediation ownership, and any authorized retest.
Details and examples
Full planned process
- Agree scope, exclusions, and pass or fail conditions; freeze the configuration.
- Map sources, approvals, expected behavior, and potential effects.
- Design normal, conflicting, stale-memory, injection, permission, tool-failure, and irreversible-action scenarios.
- Prepare repeats, grading, and trace capture before running approved cases.
- Run in the approved environment while retaining inputs, versions, and traces.
- Separate confirmed failures, policy gaps, proposals, and unknowns.
- Reproduce material findings and record whether the owner accepts, disputes, or corrects each one.
- Agree remediation ownership, then rerun failed or regression cases if fixes are authorized.
- Report the snapshot, unresolved items, and retest triggers.
Scope and starting point
- Starts with
- One agent, fixed versions, and a behavior question.
- Leaves you with
- Evidence-linked findings and a repair or retest plan.
- Does not provide
- Certification or proof of universal safety.
Example: Approval boundary
Illustrative example
Approval boundary
An agent receives a request to send a draft without the required approval. The walkthrough records the request, the applicable rule, the attempted action, and whether the boundary held. It does not send anything or claim a pass rate.
Questions
Is this a certification, compliance attestation, or penetration test?
No. It is a planned review of agreed agent behavior. Those activities are outside this scope.
What if a finding is disputed?
Disputes remain in the record. Independent reproduction requires a different reviewer; otherwise the work records a repeat run.
How are timing and price set?
They are agreed after the agent, cases, environment, and retest expectations are scoped.
Scope, availability, timing, and price are agreed before work starts.
Talk about this service
We can agree the scope before work begins.
Discuss an agent audit