Why does the number of questions change when I change what the agent can do?

Because some controls have no surface to exist on. Where a person executes every effect there is no run of the agent's own to stop, nothing it did on its own to put back, and no undo window to measure, so those controls carry a weight of zero for that shape and drop out of the divisor entirely. A dropped control is not a silent failure and it is not a free pass either: the remaining controls are weighted heavier, so the reach and identity questions carry more of the score.

Why are the basics weighted heavier for an assistive agent?

Because there is less else to carry them. An agent that can act has a stop, a cap and a rollback between a mistake and its consequences, and those absorb some of the weight. An agent that only reads has none of that machinery, so what it can reach and whose credentials it reads with are doing more of the work, and the weights say so.

Where do the bands come from?

From a product RedHub already ships in this lane. The AI Agent Go-Live Readiness Gate puts its top band at 90 and holds its worst verdict behind a gate no score can reach, so this assessment uses the same two decisions. Choosing different thresholds by feel would have made a free assessment disagree with the paid tool it recommends. The names are not identical: that product says READY flat about a deployment somebody worked through, and this one reads what you told it, so its top verdict is BOUNDED AS DESCRIBED.

Why can a gate only ever lower a verdict?

Because a weighted average is the wrong instrument for a structural failure. Twenty strong controls can carry a score while the one thing that would have limited a mistake is missing, and averaging is exactly what hides that. A gate is the place where one specific fact overrides the summary, and letting it work in the other direction would make it a bonus instead of a limit.

Why does this need both routes back missing to fail, when the security assessment for models needs a whole chain to be weak?

The arithmetic is the same and the reasoning is the opposite way round. A chain of defenses only fails when the last one does, so a conjunction there describes an attacker getting all the way through. Here the two controls are alternatives rather than links: a stop and a rollback are two different ways an effect stops being permanent, and having either one is a real position. The conjunction describes both routes being absent, not a path being complete.

Can I check the score by hand?

Yes, and that is the point of publishing every weight on this page. Multiply each mark by its weight, divide by three, sum them, divide by the weight in scope and multiply by a hundred. The result is deterministic: the same answers always produce the same score, the same band and the same first thing to fix.

How this assessment works

The assessment marks up to 24 controls from 0 to 3 on what you could show today, weights them for what the agent is allowed to do, and renormalizes over what is in scope. The result is a score out of 100 and one of three verdicts. Two gates can hold a verdict down regardless of the score, and neither can lift one.

It is deterministic. The same answers always produce the same score, the same band and the same first thing to fix. There is no model in the scoring path, which is why the whole method fits on one page.

The arithmetic

Each control carries a weight for each of the three shapes, and the weights for a shape sum to exactly 100. You mark every in-scope control from 0 to 3 for what you could show somebody today. The score is the weighted marks divided by the weight in scope, as a percentage, rounded to a whole number.

earned  = sum(mark / 3 * weight)   over in-scope controls
inScope = sum(weight)              over in-scope controls
score   = round(earned / inScope * 100)

Marking a control not applicable removes its weight from the divisor instead of scoring it zero, so declaring something out of scope never counts against you. Controls your shape has no surface for were never in the divisor at all: an agent where a person executes every effect is not graded on whether you can stop a run, because there is no run of its own to stop, and grading it there would invent a finding.

Two bands, and a third no score can reach

90 and above is BOUNDED AS DESCRIBED. Everything below it is PARTLY BOUNDED. UNBOUNDED is not a band at all: no score produces it, and the only route to it is the gate below.

That shape is borrowed rather than designed. The AI Agent Go-Live Readiness Gate that RedHub already ships puts READY at 90, FIX at everything below, and DO NOT DEPLOY behind a gate no score can reach. Its worked example is a refund agent scoring 86 out of 100 that is still DO NOT DEPLOY. Choosing different numbers by feel would have made a free assessment disagree with the paid product it recommends.

90 is the strictest top band in this portfolio, where the others sit at 80 and 75. The reason is the distance between a mistake and an effect. A compliance gap is discovered when somebody asks. An agent does not wait to be asked.

The consequence is one wide middle band, where a score of 30 and a score of 88 both read PARTLY BOUNDED. That is deliberate and it is worth knowing in advance, not discovering. The band answers whether there is a list of things to fix. The score, the domain table and the fix-first item on your result answer how long the list is and where it starts.

Why two gates, and why they only ever hurt

A gate can lower a verdict and can never raise one. That is the whole mechanic, and it is the reason a verdict here means something a weighted average does not.

No route back. Two of the 24 controls are routes back: whether you can stop a run that is already in progress, and whether you have a rollback path you have run. If both read 1 or below, the verdict is UNBOUNDED at any score. Bringing either one up to a mechanism you have actually used releases it.

Either route on its own is a genuine bound. A quick stop limits how much damage there is even where you cannot undo it. A reliable rollback recovers the damage even where you cannot stop quickly. Having neither is not a low mark on two controls; it is the case where a mistake continues for as long as nobody notices and then stays, which is a difference in kind.

The threshold is 1 rather than 2 for a specific reason. At a mark of 1 the stop is pulling a credential or taking the service down, and the rollback is fixing it by hand, record by record. Both are real things a person can do and neither is a control: one breaks something else to achieve it, and the other is the incident rather than the recovery. At 2 there is a mechanism somebody has used, which is thin and is not nothing.

It cannot fire on an assistive agent, and that is the right answer and not a hole. Where a person executes every effect there is no run of the agent's own to stop and nothing it did on its own to put back. The person is the bound.

The dark surface. A top verdict cannot sit on an in-scope control that reads zero. It is held at PARTLY BOUNDED instead. Without this a weighted average quietly fills the hole in: twenty strong controls carry the number while the one you have not started disappears into the mean.

Two worked results

An external agent scoring 85 returns UNBOUNDED. It has a documented approval list, a full action log and a tested set of cases, but stopping a run means pulling a credential, putting it back means doing it by hand record by record, and the only cap lives in the prompt. Each of those three is a mark of one, and between them they carry 22 of the hundred points for that shape. Answer all three at zero instead and the same description reaches 78, which is the most it can score. An internal agent scoring 60, thin across every reach question but with a stop control that gets used and a rollback that has been run, returns PARTLY BOUNDED.

The second is a worse score and a better answer, and the reason to publish both is that the ordering is the whole point of the instrument. The score is context. The gate is the answer.

Every control and its weight

24 controls across nine domains, ordered on a clock: before, during, after. A weight of zero means the shape has no surface for that control and it is not scored. The two marked as routes back are the ones the first gate reads.

Control	Assistive	Internal	External
Is there a current list of every tool, connector and system this agent can reach?Reach	10	6	5
For each connector, do you know the exact permissions it holds, and were they narrowed from the default?Reach	10	6	6
Are the connectors that can change or delete things separated from the ones that only read, and named as such?Reach	n/a	5	5
Is there somewhere to run this agent that is not production, with data it cannot damage?Reach	5	3	3
Does the agent act under an identity of its own, and not under a person's account?Identity and credentials	8	4	3
Are its credentials held in a secrets store, and not in configuration, code or a prompt?Identity and credentials	10	5	4
Is there a way to kill one of its credentials that you have used?Identity and credentials	8	4	4
For every third-party server, skill or plugin this agent loads, do you know who publishes it and which version you are running?Third-party components	7	3	3
Is a new component reviewed before it is installed, against what it asks for?Third-party components	7	3	3
Do you know which third-party components hold or can read your credentials?Third-party components	6	2	2
Is there a written rule set saying which actions are allowed in which circumstances, checked before the action runs?Before: authorization	n/a	4	4
Is the list of actions needing a person's approval decided by whether the action can be undone, rather than by how risky it feels?Before: authorization	n/a	5	6
Does the agent refuse a task outside its stated purpose?Before: authorization	5	3	3
Can you stop a run that is already in progress?During: stop and bounds · route back	n/a	8	9
Is there an enforced cap on how much a single run can do, in records, messages or money?During: stop and bounds	n/a	5	6
Is there a rollback path you have run?After: putting it back · route back	n/a	7	7
For an action you can undo, does noticing plus undoing fit inside the window where undoing still helps?After: putting it back	n/a	3	5
Is there a record of the actions the agent took, separate from its conversation logs?After: who authorized it	6	5	5
For an action the agent took, can you say who authorized it: a person, a policy, or a standing approval?After: who authorized it	5	4	5
Is there a set of real cases with known-correct outcomes that this agent is run against before a change ships?Evidence it works	6	4	3
Do you have a baseline you compare against, so you would notice this agent getting worse?Evidence it works	4	2	2
Did this agent run in dry-run, or on a small slice, before it ran on everything?Change control	3	3	3
Is adding a tool or widening a permission a decision somebody makes, or a side effect of a configuration change?Change control	n/a	3	2
Was there a review against a written list before this agent was allowed to run without somebody watching?Change control	n/a	3	2

The three shapes

Assistive. The agent reads, drafts and suggests. Every effect on a real system passes through a person who reads it first and clicks the button. Pick this for a research agent, a drafting agent, or a triage agent that writes a recommendation into a queue somebody works. The exposure is what it can reach and read, not what it can do.

Internal. The agent writes. It updates records, files tickets, moves data, changes configuration. The effects are real and they land inside systems you control. Pick this for an agent that maintains a CRM, triages and closes tickets, reconciles data between two of your own tools, or runs a scheduled job against your own database.

External. The agent sends, posts, pays, books, orders, or calls an interface somebody else owns. The effect leaves your control at the moment it happens. Pick this for anything that emails a customer, moves money, publishes, places an order, or writes into a partner's system. The exposure is everything the narrower two have, plus the fact that undo is a request rather than a command.

What this assessment cannot do

It cannot verify a single answer. Nothing here touches an agent, fetches a URL you supply, sends a request or reads a file, and that is a permanent design decision rather than a missing feature. A tool in this category that accepts a hostname and reaches out to it server-side is a request-forwarding proxy with a marketing page attached, whatever it is called. Every number this returns is arithmetic on what you told it.

It is not a penetration test. That is somebody attempting to break a running system with permission to do so, and it produces findings about that system on that day. It is not an audit of a running system, and it certifies nothing.

It also cannot tell you whether the agent is any good at its job. Reach, stopping and recovery are questions about consequence, and a useless agent with a tested stop scores well on all of them. And it says nothing about likelihood: everything here is the size and duration of a mistake and not the chance of one, because the size is a fact about your configuration and the chance is a forecast.

That is why the top verdict is called BOUNDED AS DESCRIBED and not bounded. The number is borrowed from the paid go-live gate, which reads five controls somebody works through against a real deployment. This one reads what you told it, and the longer name has to survive being read on a share card by somebody who did not answer any of the questions.

It does not ask a single question about prompt injection, jailbreaking, output filtering or what the model remembers. Those are real and they are a different assessment with different controls. This one is indifferent to why the agent was wrong. What we sell against these gaps is listed in full, with the arithmetic for the one bundle this site does not recommend.

Common questions

Why does the number of questions change when I change what the agent can do?: Because some controls have no surface to exist on. Where a person executes every effect there is no run of the agent's own to stop, nothing it did on its own to put back, and no undo window to measure, so those controls carry a weight of zero for that shape and drop out of the divisor entirely. A dropped control is not a silent failure and it is not a free pass either: the remaining controls are weighted heavier, so the reach and identity questions carry more of the score.
Why are the basics weighted heavier for an assistive agent?: Because there is less else to carry them. An agent that can act has a stop, a cap and a rollback between a mistake and its consequences, and those absorb some of the weight. An agent that only reads has none of that machinery, so what it can reach and whose credentials it reads with are doing more of the work, and the weights say so.
Where do the bands come from?: From a product RedHub already ships in this lane. The AI Agent Go-Live Readiness Gate puts its top band at 90 and holds its worst verdict behind a gate no score can reach, so this assessment uses the same two decisions. Choosing different thresholds by feel would have made a free assessment disagree with the paid tool it recommends. The names are not identical: that product says READY flat about a deployment somebody worked through, and this one reads what you told it, so its top verdict is BOUNDED AS DESCRIBED.
Why can a gate only ever lower a verdict?: Because a weighted average is the wrong instrument for a structural failure. Twenty strong controls can carry a score while the one thing that would have limited a mistake is missing, and averaging is exactly what hides that. A gate is the place where one specific fact overrides the summary, and letting it work in the other direction would make it a bonus instead of a limit.
Why does this need both routes back missing to fail, when the security assessment for models needs a whole chain to be weak?: The arithmetic is the same and the reasoning is the opposite way round. A chain of defenses only fails when the last one does, so a conjunction there describes an attacker getting all the way through. Here the two controls are alternatives rather than links: a stop and a rollback are two different ways an effect stops being permanent, and having either one is a real position. The conjunction describes both routes being absent, not a path being complete.
Can I check the score by hand?: Yes, and that is the point of publishing every weight on this page. Multiply each mark by its weight, divide by three, sum them, divide by the weight in scope and multiply by a hundred. The result is deterministic: the same answers always produce the same score, the same band and the same first thing to fix.

In one line

Score 90 or above with every route back in place and nothing reading zero, and the verdict is BOUNDED AS DESCRIBED. Lose both routes back and it is UNBOUNDED whatever the score says.

Run the assessment What we sell against these gaps