Understand the evidence. Take the right action.

Getting started

1. Activate your invitation.Open your private beta invitation, register the invited email address and accept the current terms.
2. Verify your email.Use the time-limited verification link. Production administration and sensitive owner actions also require MFA.
3. Create an assessment.Name the agent, select its type and answer all 25 controls using the system as it exists today.
4. Review the free result.Use the score, risk band and top findings to decide whether deeper evidence is needed.

How the process works

The evidence ladder

Complete an assessment correctly

• Scope one agent or stable deployment. Do not combine agents with different permissions or controls.
• Answer the current state. Planned safeguards do not count as implemented controls.
• Choose the evidence level. “Owner statement” means asserted; “documented” means a reviewable record exists; “tested” means a repeatable check has passed.
• Protect the result. Assessments are private by default. Enable a public summary only when safe.
• Reassess material changes. New tools, data, models, permissions, prompts, memory or architecture can change risk.

Understand your result and report

Risk score (0–100)

A prioritisation measure combining inherent exposure, control gaps and uncertainty. It is not a percentage probability of breach.

Risk band

A Low, Moderate, High or Critical grouping used to communicate urgency.

Finding

A specific weakness or exposure with impact, evidence and recommended control.

Evidence confidence

How strongly available evidence supports the stated control.

Deployment decision

A decision-support recommendation. An accountable human must approve the real deployment.

Inspector guide

1. Select the matching assessment.Evidence must relate to the agent and repository assessed.
2. Create a one-time command.Review the command, source, checksum and configuration first.
3. Run it locally.It checks tracked files and configuration without uploading source contents, matched secrets or environment values.
4. Upload the signed bundle.The service verifies release identity, integrity, scope and replay protection.
5. Review observations.Confirm false positives and connect signals to remediation work.

It proves: the accepted bundle matches the published scanner and was not changed after generation.

It does not prove: repository completeness, production equivalence, runtime safety or absence of pre-scan tampering.

Red Team guide

1. Use an authorised non-production target.Only local, test or staging environments are accepted.
2. Write the Rules of Engagement.Name the target, authoriser, authority basis, endpoint, time window, emergency contact and prohibited actions.
3. Use synthetic data and dry-run tools.Never expose customer data, credentials, payments or destructive tools.
4. Run repeated trials.One to five trials show whether behaviour is stable or intermittent.
5. Stop on scope change.Revoke approval or use the emergency stop if conditions no longer match.

Remediate and retest

1. Prioritise exploitable paths.Start where broad authority, untrusted input and weak containment combine.
2. Assign an owner and deadline.Turn each recommendation into tracked work.
3. Define closure evidence.State what document, configuration or test will prove the fix.
4. Retest the same scope.Compare only meaningfully comparable targets and conditions.
5. Accept residual risk explicitly.Document approver, rationale, duration and compensating controls.

Choose the right level

Checkout shows exact taxes and renewal details. Manage active subscriptions from the dashboard.

Key vocabulary

AI agent

A model-based system that plans or chooses actions, often using tools, memory, data sources or other agents.

Autonomy / excessive agency

Autonomy is independent action. Excessive agency means more permission, reach or freedom than the task requires.

Attack path

A connected sequence of conditions from an entry point to a harmful outcome.

Data exfiltration

Unauthorised transfer or disclosure of sensitive data outside its approved boundary.

Inherent exposure

Risk created by what the agent can access and do before safeguards are considered.

Likelihood

How plausible a harmful event is under defined conditions; it is not certainty.

MCP / tool poisoning

MCP connects models to tools and context. Tool poisoning uses malicious tool metadata, content or behaviour to influence the agent.

Memory poisoning

Planting untrusted information in persistent memory so it affects later decisions.

Prompt injection

Instructions crafted to redirect behaviour. Direct injection comes from a user; indirect injection is embedded in content the agent reads.

Residual risk

Risk remaining after implemented safeguards and compensating controls.

Severity

The seriousness of plausible impact, considered with scope and control context.

Synthetic data

Artificial test data that contains no real customer or secret information.

Dry-run tool

A test implementation that records a requested action without executing the real-world side effect.

Rules of Engagement (RoE)

Written authorisation defining the target, approver, window, boundaries, contacts and prohibited actions.

False positive / false negative

A false positive reports an absent problem; a false negative misses a present problem.

Common questions

Safety and limitations

• AgentRiskLayer is security decision support—not an independent penetration test, audit, certification, legal opinion, insurance product or guarantee.
• Results depend on accurate scope, truthful answers and supplied evidence.
• Static inspection does not prove runtime behaviour or production equivalence.
• Controlled outcomes apply only to the tested cases, adapter and conditions.
• Use only systems you own or are explicitly authorised to assess. Never submit real secrets or unnecessary personal data.
• High-impact decisions require accountable human review and, where appropriate, independent professional advice.