methodology
The review covers the agent execution boundary: the line between what a model asks for and what the system actually does. Every review follows the same written method and fills the same report template, so you can read what you are buying before you book.
01 rules of engagement
The review works from what you have released. It never needs your credentials, and nothing is tested that the written scope does not name.
serious-finding protocol
If we judge a finding serious, that line of testing stops and we write to your named contact directly, out of band, the same day. It is not held back for the report.
02 the passes
We pin the artifact set and check it ourselves. The commit has to resolve and the named branch has to point at it. The package tarball is downloaded and hashed locally against the registry's published digest. Anything we cannot resolve stays in the report, next to your explanation of it. Conflicts of interest are declared in writing before testing starts.
One row per tool the agent can call, with its arguments, the authority it runs under, the gate in front of it, what it can reach, and whether the call is logged. A cell nobody can fill is recorded as unknown, and unknown is a finding. If the surface is too large to enumerate in full, the report says so before the table starts, with the sampling rule and the full count.
The authorization path and the logging call sites are read before anything live is touched. The authorization and audit-trail checklists are worked on paper first.
Hands-on testing of reach and prompt-boundary integrity, against an isolated environment only. Every result gets a reproduction script, negative results included.
We take one ordinary action the system performed, ideally one you choose, and try to reconstruct it end to end from the log alone. Then we look for our own adversarial testing in the same log. If it is not there, the report says so plainly.
If an earlier pass runs long, it takes time from the next pass. It never takes time from the report.
03 what we test
Each checklist is shown with the closest categories from the OWASP Top 10 for LLM Applications (2025). The mapping is ours, included so your reviewer can place each check against a framework they already use.
The multi-agent trust check follows Provenance Is Not Independence: two agents reading the same poisoned source are one source, not two.
04 how findings are graded
CVSS 3.1, with the full vector printed so your reviewer can recompute the score. Every score is labelled as our own assessment. We check the attack vector before we write the number.
How much we actually showed. A finding with a high score and an inferred grade is reported as exactly that.
| Reproduced | We ran it and it did the thing. The script and the output are in the report. |
|---|---|
| Observed | We saw the behaviour but did not build a clean reproduction. |
| Inferred from code | The code path permits it. It was not executed. |
| Theoretical | A class of issue that applies to this design, with no evidence in this codebase. |
An absence is never printed as a bare pass or a checkmark. Every clean line carries its grade and a statement of what was checked, in the same sentence, so it cannot be quoted back later as "you said it was fine."
| Exercised, property held | The isolated target was run and the tested behaviour did not occur. States what was run and what input was sent. |
|---|---|
| Searched, not found | Code or documentation was read and the property was not in what was read. States exactly what was read. |
| Not exercisable from the released artifact | The released surface offers no path to test it. States every command and flag examined, and that this is a limit of the artifact, not a result about what lies behind it. |
Each public claim about the product is written down as a testable statement and given one verdict.
05 the report
The founder who commissioned it, and the enterprise security reviewer who is holding up the deal. The executive summary and the findings are for the first. The scope, the independence statement, the clean results and the questionnaire mapping are for the second.
appendix b
Every finding and every clean result, mapped to the questions enterprise security questionnaires ask. The deployment configuration each answer assumes is stated above the table, so your team can answer from it directly.
You may share the report with your own customers and prospects. Appendix C can be withheld at your discretion, and the report is written to stand without it.
| §1 | Artifacts reviewed, and how they were checked |
|---|---|
| §2 | Scope and rules of engagement, as executed |
| §3 | Independence and conflicts |
| §4 | Executive summary |
| §5 | Claims verification, when your public claims are in scope |
| §6 | The execution boundary, as built |
| §7 | Findings |
| §8 | What was tested and found nothing |
| §9 | Audit trail under challenge |
| §10 | Residual risk, and what the review does not cover |
| App. A | Tool inventory |
| App. B | Enterprise security questionnaire mapping |
| App. C | Reproduction detail |
06 what the review does not cover