Permissions and data boundaries
Review agent and tool access, data boundaries and resource budgets. Define where changes stop for approval and which limits are enforced by software.
AI Security and Governance
AI security and governance define how an AI system may access information, use tools and make changes. We assess risks, build controls and document findings your team can review.
Make the Boundaries Explicit
The review follows the actual workflow, including its tools, data, identities and points where a person needs to decide.
Agent and tool testing
Assess how the system handles untrusted input, tool misuse and requests beyond its role. Record reproducible findings rather than unsupported risk labels.
Reviewable evidence
Document controls, approval behaviour and action records. Where scoped, map evidence to frameworks such as NIST AI RMF or ISO 27001, distinguishing findings, fixes and remaining issues.
Evidence, With Clear Limits
Security testing is scoped and cannot prove the absence of every risk. We distinguish engineering controls and requirement mapping from certification or a guarantee of compliance.
Example Workflow
From a Finding to a Verified Fix
An illustrative security-review sequence; the tests are chosen for the system and its exposure.
Define the surface
Identify the workflow, tools, data and trust boundaries.
Exercise the controls
Test permitted behaviour and representative misuse.
Document and address
Record evidence and prioritise the changes with your team.
Retest
Check the fix and document unresolved limitations.
Systems and demonstrations
Explore the workflow, the controls and the decisions people retain.
Security engineering
AI Security Testing
Authorised assessments test chatbots, copilots, retrieval systems and agents against their actual exposure. Potential findings are validated and mapped to relevant security frameworks within the agreed scope.
Agree the surface
Define the targets, permitted actions, data handling and available deployment or pipeline environment.
Test and validate
Exercise the controls and check reproducible evidence behind potential findings.
Report and retest
Provide an executive report, developer-ready findings, control evidence and a remediation plan, with retesting where scoped.
Controls and responsibility
Work stays within authorised targets and actions. Data handling is agreed before model calls, including on-premise arrangements where required. Findings can reference OWASP LLM Top 10, MITRE ATLAS and NIST AI RMF; requirement mapping is not certification.
Security engineering
Agent Tool and Skill Security
Permissions and tool boundaries constrain what untrusted input can cause. The engineering covers declared access, controlled skill versions, connection gates and confirmation around sensitive actions.
Declare and enforce
Tools declare their required permissions, which are checked before execution. Undeclared connections are blocked.
Control changes
Approved skill versions are signed and locked so changes can be detected. Pipeline checks apply the agreed release gates.
Review sensitive actions
Dry runs or confirmation support review before sensitive execution, with an audit record available to the team.
Controls and responsibility
The boundary limits what a tool can do with input. A text safety check cannot grant permission to execute an undeclared action. Deployment and on-premise review arrangements are scoped with the customer.
Questions About the Service
Can you assess an existing AI system?
Yes. The review can begin with the current workflow, architecture and available test environment. Access and testing boundaries are agreed before the assessment.
Does this certify compliance?
No. We can document controls and map relevant requirements within scope. Certification, legal interpretation and formal assurance remain separate activities.
What do we receive from testing?
The agreed review produces documented findings with supporting evidence, recommended changes and retest results where included. The scope and evidence standard are defined upfront.
Last updated
Tell Us What You Want to Build
Bring a workflow, a requirement or a problem your team wants to solve.