surface 01
Reach
The execution boundary. What a tool call can do, what authority it inherits from the caller, and what happens when the input arrives from somewhere you did not expect.
independent Agent Boundary Reviews · a brand of botzr Corp
We verify agents do what they are intended to do.
We review the boundary an AI agent operates inside: what a tool call can reach, what authority it inherits, and what the memory still holds after you have asked it to forget.
dreamd.dev is where the work is delivered: isolated test environments, written reports, and the open-source daemon.
the offer
What is an Agent Boundary Review?
An Agent Boundary Review is an independent, adversarial look at what an AI agent can actually do versus what its documentation says it can do: the execution boundary, the authority a tool call inherits, and what happens when input arrives from somewhere unexpected. It is delivered as a written report.
01 delivery
Three things are delivered here.
- Environments
-
Local and containerised environments we stand up and control. Hands-on testing runs against an isolated environment only.
Rules of engagement - Reports
-
Every review ends in a written report. Findings and clean results are both graded, and mapped to the questions enterprise security questionnaires ask.
What the report contains - The daemon
-
dreamd, the open-source memory layer we maintain. Its specification is published here, and its source is on GitHub.
About dreamd
02 who this is for
Someone outside has asked you to prove it.
A customer's security questionnaire asks what your agent can touch. An acquirer's diligence asks the same thing in different words. A regulator asks whether the data you deleted is really gone.
These questions are not answered by an organisational control. SOC 2 and a trust center describe how a company runs. Neither one tests what a tool call can reach at three in the morning when the input came from a web page nobody reviewed.
That gap is our subject. The standards are not wrong; they answer a different question, and the one you were asked still needs an answer.
03 the subject
Two surfaces, and we work on both.
surface 02
Memory
What the system retained, what it retrieved, and whether it can honestly say that something is not there. Proving an agent forgot a fact is harder than proving it learned one.
04 methodology
One written method, published.
Every Agent Boundary Review follows the same written method and fills the same report template.
- pass 00
Pin the artifacts
The exact version and commit under review, resolved and hashed by us rather than taken on assertion.
- pass 01
Map the tool surface
One row per tool the agent can call, with the authority it runs under and what it can reach.
- pass 02
Read the boundary
The authorization path and the logging call sites, read before anything live is touched.
- pass 03
Test it adversarially
Unintended reach and prompt-boundary integrity, against an isolated environment we stand up ourselves.
- pass 04
Challenge the audit trail
One ordinary action reconstructed from the log alone, then a search for our own testing in the same log.
- pass 05
Write the report
Findings graded on two axes, and mapped to the questions enterprise security questionnaires ask.
05 how we work
The parts most firms leave out.
Every report states the effort that went into it, in days, on the cover. Severity and difficulty are scored separately, because a finding that is catastrophic and nearly impossible to reach is not the same as one a stranger can trigger from a form field.
Every report carries a section naming what we did not cover and why. A review with no stated limits is telling you about its author, not about your system.
We publish our own negative results, including the ones that overturned something we had previously claimed. The research lab, Botzr Research, exists for that.
We never run the systems we assess, and we never assess systems we run.
06 open source
We also build dreamd.
dreamd is a local-first memory layer for AI coding agents. The plain JSONL in your repository is the memory, and the daemon reads and writes it. Apache-2.0, no telemetry, two MCP tools.
It is a tool we maintain, not the practice. Working on agent memory in the open is how we learned which questions about it are hard.