The agent layer
AI Agent Security Audit
What can your agent reach, and what happens when it is wrong? A free, deterministic self-assessment of permissions, connectors and blast radius.
An AI agent security audit asks what an agent is allowed to reach and what happens when it acts wrongly. It does not ask why it was wrong. A correct agent working from a stale record, a retry loop, and a successful attack all produce the same morning, so this assessment asks about reach, stopping, reversal and attribution, not about prompts. It runs up to 24 questions across nine domains, weights them for what the agent is allowed to do, and returns a score out of 100 with one of three verdicts. An agent where a person executes every effect is asked fifteen of them.
It is a self-assessment. Nothing here touches an agent, so a good score says the limits you described are sound, not that anything has been tried against them.
The domains are laid out on a clock, because the three moments have different controls and are worth separating. Before is authorization, which happens while nobody knows anything is wrong. During is the stop, which is the only control that works in the window where you know and it is still going. After is putting it back, and saying who authorized it. The three are asked separately for that reason: having the first says nothing about the second, and the third is the one easiest to assume without checking.
Two gates can hold the verdict down whatever the score. If neither route back is a control, meaning stopping a run comes down to pulling a credential and putting it back comes down to doing it by hand, the verdict is UNBOUNDED at any number: either route as a mechanism you have used would have been a bound. And a top verdict cannot sit on a control that reads zero. Neither gate can improve a verdict. The top band starts at 90, which is the strictest bar in this portfolio and is the threshold RedHub already ships in this lane. The whole method is published, weights and bands included, so you can recompute the number by hand.
Nothing here touches an agent. Nothing is fetched, scanned, called or probed, and nothing you type is stored by us: your answers ride inside your own result link. Opening or sharing that link sends the address, and so the answers, to our host the way any URL does, where it appears in ordinary server logs. Nothing in it names you or your company. It is a self-assessment of what you could show today, not a penetration test, not an audit of a running system and not a certification.
What is this agent allowed to do?
This decides which questions have a surface to exist on. Where a person executes every effect there is no run to stop and nothing the agent did on its own to put back, so those questions are dropped rather than scored against you. Pick the widest thing the agent can do without somebody clicking a button, not the thing it usually does.
Results are subject to the Terms, which cover how a result may be described to somebody else. Nothing you answer is stored or sent to us.
Common questions
- What is an AI agent security audit?
- It is an examination of what an AI agent is permitted to reach, what it can cause, and what happens when it acts wrongly. It covers the connectors and credentials it holds, the third-party components it loads, the rules that decide which actions are allowed, whether a run can be stopped while it is happening, whether its effects can be put back, and whether anyone can say afterwards who authorized what it did. A real audit is performed by somebody independent who inspects the system. This assessment is a self-declared picture of the same ground, scored deterministically, and it inspects nothing.
- How is this different from an LLM security audit?
- An LLM security audit asks whether somebody can make the model misbehave: what enters its context, which instruction wins when two conflict, and what comes out. This asks what happens when the agent acts, and it does not care why. An agent does not have to be attacked to empty a table. A correct agent working from a stale premise, a retry loop, and a connector scoped by whoever clicked through the consent screen all produce the same morning as a successful injection does. So nothing here asks about prompt injection or output filtering, and the questions are about reach, stopping, reversal and attribution instead.
- Why can a high score still come back UNBOUNDED?
- Because one gate reads two controls, not the average. If neither route back is a control, meaning stopping a run comes down to pulling a credential and putting it back comes down to doing it by hand, the verdict is UNBOUNDED at any score, because nothing you described bounds how far a mistake gets. Either route as a mechanism you have used releases it. The gate cannot fire on an agent where a person executes every effect, because there the person is the bound.
- Why does the top verdict need 90 out of 100?
- It is the threshold RedHub already ships in this lane, in the AI Agent Go-Live Readiness Gate, and it is the strictest bar of any assessment in this portfolio. The reasoning is that the distance between a mistake and an effect is shorter here than anywhere else: an agent that acts does not wait for anybody to notice. Below 90 there is one band rather than two, which means a score of 30 and a score of 88 read the same. That is deliberate. The band tells you whether there is a list of things to fix; the score, the domain table and the fix-first item tell you how long it is.
- Does this touch my agent, or send anything to it?
- No. Nothing is fetched, scanned, called or probed. Every question is answered by you about a system you describe, and the whole assessment runs in your browser. That is a permanent design decision rather than a missing feature: a security tool that accepts a hostname and reaches out to it server-side is a request-forwarding proxy with a marketing page attached, and it is the wrong thing to build whatever it is called.
- What happens to my answers?
- Nothing you type goes into a database and no record is kept tying a result to a person. The answers ride inside the result link itself, which is why the page works for somebody you send it to and why there is nothing here to look up. It does mean that opening or sharing a result sends that address to our host the way any URL does, where it appears in ordinary server logs. Nothing in it names you, your company or your systems.
The three shapes, briefly
Assistive. The agent reads, drafts and suggests. Every effect on a real system passes through a person who reads it first and clicks the button.
Internal. The agent writes. It updates records, files tickets, moves data, changes configuration. The effects are real and they land inside systems you control.
External. The agent sends, posts, pays, books, orders, or calls an interface somebody else owns. The effect leaves your control at the moment it happens.