Would your AI agent pass a security review?
Most AI pilots stall at a sign-off, not a model failure, and security and identity are where they stall first. Ten questions show how your agent scores on identity, access, tool controls and audit trail, and on production readiness. Runs in your browser; nothing is stored unless you ask for the scorecard.
- 01 · Agent identity
Does each AI agent have its own identity (in Okta, AWS IAM or similar), not a shared account or someone's login?
- 02 · Least privilege
Can the agent reach only the data and systems its task needs, and nothing else?
- 03 · Tool controls
Is there an allow-list of the tools and APIs it may call, with approval before high-impact actions?
- 04 · Security monitoring
Is agent activity visible to your security team, alongside endpoints and users (for example in CrowdStrike Falcon Guardian)?
- 05 · Audit trail
Could you show a customer or an auditor exactly what the agent did, when, and on whose behalf?
- 06 · Your environment
Does it run in an environment your IT and security team control, with secrets kept out of prompts and code?
- 07 · Evaluation
Can you show, with numbers, how well it performs on your own data, and re-test after every change?
- 08 · Review
Is AI output checked before it reaches a customer, a proposal or a deliverable, by a named reviewer or an LLM judge calibrated against them?
- 09 · Cost
Do you know what it will cost per month at full use, with limits in place?
- 10 · Ownership
Is it connected to the systems your team works in, with an owner and a runbook?
Guidance for your team, not a certification or an audit. Don't enter sensitive details.
Want the gaps closed, not just found?
30 minutes with an engineer, no slides. We agree the scope on the call and send pricing after.