Agent permissions and controls
What the AI system can read, change, send, delete, execute, retrieve, approve, or remember, and which actions require controls or human approval.
Board advisory
Understand the AI risks behind a launch, vendor or investment decision.
Review agent permissions, connected tools, document access and launch risks in a focused board briefing or recurring advisory sessions.
What you receive
What the engagement covers.
- A pre-brief scoping call to identify the decision and audience
- A 60 to 120 minute live briefing for executives, board members, counsel, or investors
- Plain-language explanation of agent permissions, data access, credentials, and approvals
- Optional written summary for leadership circulation
- Optional recurring sessions to review board materials, major changes, and upcoming decisions
- Recommendations for further assessment when questions remain
01
What the engagement covers
Abuse paths leadership should understand
Prompt injection, indirect instructions, excessive agency, weak approval gates, RAG leakage, tool-output manipulation, and CI/CD agent risk.
Implications for the decision
How the technical findings affect launch plans, customer diligence, board oversight, legal questions, and vendor selection.
02
When to use it
- A board needs an explanation of agent permissions and risks before making a decision.
- A leadership team wants an outside assessment before approving production access.
- An investor or acquirer needs to understand whether AI claims are supported by controls.
- A CISO or general counsel needs help communicating risk to non-technical stakeholders.
- Leadership wants regular technical review as the product, controls, or vendors change.
Limits
Scope and limitations.
- A briefing or advisory relationship is not a penetration test, certification, or comprehensive assessment.
- Written summaries for circulation are agreed separately.
Next step