What are you trying to do?

Getting started

1. Create your account.Register with your email address, create a strong password and accept the current terms.
2. Verify your email.Use the time-limited verification link. Production administration and sensitive owner actions also require MFA.
3. Check one agent.Name it, choose what it does and answer one plain-language question at a time using the system as it exists today.
4. Read the next action first.The result tells you whether to proceed, pause for proof or fix important risks before wider use.

Start with one safe browser check

1. Open your existing protected agent.Community includes one active project, so reuse it instead of creating a duplicate.
2. Run the safe protection check.One button tests missing approval, a changed amount, the exact approved action and approval reuse with fictional data.
3. Read the result in plain language.The browser shows what was blocked, what was allowed once and what the test does not prove.
4. Reveal technical controls only when needed.A developer can then create a connection key, copy an integration example and connect the real agent.
5. Review decisions and fixes.Runtime evidence, inventory, remediation and audit history remain available in the technical view.

The guided check does not call a real refund system and does not need a terminal or project API key. It proves the controlled hosted policy path only; it does not prove that a customer agent has been integrated correctly.

Check, understand, fix and prove.

The evidence ladder

Complete a security check correctly

• Scope one agent or stable deployment. Do not combine agents with different permissions or controls.
• Answer the current state. Planned safeguards do not count as implemented controls.
• Choose the evidence status. “No proof yet” records no supporting evidence. “My answer only (not verified)” records a customer assertion only. “I have supporting evidence to attach (not verified yet)” means evidence exists but remains unverified until it is linked to this assessment and reviewed or tested. Selecting an option in the assessment never creates verified evidence.
• Protect the result. Assessments are private by default. Enable a public summary only when safe.
• Reassess material changes. New tools, data, models, permissions, prompts, memory or architecture can change risk.

Understand your result and what to do next

Risk score (0–100)

A prioritisation measure combining inherent exposure, control gaps and uncertainty. It is not a percentage probability of breach.

Risk band

A Low, Moderate, High or Critical grouping used to communicate urgency.

Finding

A specific weakness or exposure with impact, evidence and recommended control.

Evidence confidence

How strongly available evidence supports the stated control.

Deployment decision

A decision-support recommendation. An accountable human must approve the real deployment.

Code and configuration check

1. Select the matching assessment.Evidence must relate to the agent and repository assessed.
2. Create a one-time command.Review the command, source, checksum and configuration first.
3. Run it locally.It checks tracked files and configuration without uploading source contents, matched secrets or environment values.
4. Upload the signed bundle.The service verifies release identity, integrity, scope and replay protection.
5. Review observations.Confirm false positives and connect signals to remediation work.

It proves: the accepted bundle matches the published scanner and was not changed after generation.

It does not prove: repository completeness, production equivalence, runtime safety or absence of pre-scan tampering.

Red Team guide

1. Use an authorised non-production target.Only local, test or staging environments are accepted.
2. Write the Rules of Engagement.Name the target, authoriser, authority basis, endpoint, time window, emergency contact and prohibited actions.
3. Use synthetic data and dry-run tools.Never expose customer data, credentials, payments or destructive tools.
4. Run repeated trials.One to five trials show whether behaviour is stable or intermittent.
5. Stop on scope change.Revoke approval or use the emergency stop if conditions no longer match.

Remediate and retest

1. Prioritise exploitable paths.Start where broad authority, untrusted input and weak containment combine.
2. Assign an owner and deadline.Turn each recommendation into tracked work.
3. Register implementation evidence.Link an AgentRiskLayer inventory snapshot from the same project. Customer-provided references remain visible as unverified attestations and do not satisfy readiness.
4. Retest the current policy.Link a runtime event produced under the current published policy; historical-policy events cannot satisfy the current gate.
5. Upgrade legacy closure records explicitly.Start the evidence-upgrade flow to preserve the old status and notes, then perform a new compliant retest.
6. Accept residual risk explicitly.Document approver, rationale, duration and compensating controls.

“Ready for human deployment review” means the required scoped records exist; it is not an automated deployment approval or independent certification.

Start, assess, protect or scale

Prices and limits are loaded from the same server catalogue used for billing and entitlement enforcement. Checkout shows exact taxes and renewal details.

Key vocabulary

AI agent

A model-based system that plans or chooses actions, often using tools, memory, data sources or other agents.

Autonomy / excessive agency

Autonomy is independent action. Excessive agency means more permission, reach or freedom than the task requires.

Attack path

A connected sequence of conditions from an entry point to a harmful outcome.

Data exfiltration

Unauthorised transfer or disclosure of sensitive data outside its approved boundary.

Inherent exposure

Risk created by what the agent can access and do before safeguards are considered.

Likelihood

How plausible a harmful event is under defined conditions; it is not certainty.

MCP / tool poisoning

MCP connects models to tools and context. Tool poisoning uses malicious tool metadata, content or behaviour to influence the agent.

Memory poisoning

Planting untrusted information in persistent memory so it affects later decisions.

Prompt injection

Instructions crafted to redirect behaviour. Direct injection comes from a user; indirect injection is embedded in content the agent reads.

Residual risk

Risk remaining after implemented safeguards and compensating controls.

Severity

The seriousness of plausible impact, considered with scope and control context.

Synthetic data

Artificial test data that contains no real customer or secret information.

Dry-run tool

A test implementation that records a requested action without executing the real-world side effect.

Rules of Engagement (RoE)

Written authorisation defining the target, approver, window, boundaries, contacts and prohibited actions.

False positive / false negative

A false positive reports an absent problem; a false negative misses a present problem.

Common questions

Safety and limitations

• AgentRiskLayer is security decision support—not an independent penetration test, audit, certification, legal opinion, insurance product or guarantee.
• Results depend on accurate scope, truthful answers and supplied evidence.
• Static inspection does not prove runtime behaviour or production equivalence.
• Controlled outcomes apply only to the tested cases, adapter and conditions.
• Use only systems you own or are explicitly authorised to assess. Never submit real secrets or unnecessary personal data.
• High-impact decisions require accountable human review and, where appropriate, independent professional advice.