Skip to content
TKOResearch

Sample artifacts

See what an AI-security review report includes.

Illustrative reports and supporting records show what you can expect from a scoped AI-security assessment. The examples contain no client material.

Request the sample packageRead the approach

What you receive

What the engagement covers.

  • Executive Go/No-Go memo
  • Findings register
  • Trust-boundary map
  • Permission matrix
  • Abuse-case matrix
  • Remediation roadmap
  • Artifact appendix

What you receive

Sanitized sample pages

These examples show a decision memo, findings and supporting records. A client report identifies the systems reviewed and the decision it supports.

Go/No-Go memo excerpt

Decision: pilot-only until high-impact tool calls require explicit approval and retrieval filters are retested against tenant-boundary abuse cases.

  • Launch blockers: production write tool, missing approval log, stale metadata filter
  • Acceptable pilot scope: read-only tools, synthetic customer data, named operator
  • Leadership decision: expand pilot after two controls are validated

Findings register row

AB-03: Indirect prompt injection can influence a ticket-update tool through retrieved customer notes.

  • Severity: High
  • Boundary: RAG content to tool call
  • Recommended fix: treat retrieved instructions as data, require operator approval, log rejected actions

Trust-boundary map excerpt

User request -> application gateway -> system prompt -> retrieval layer -> model context -> MCP server -> ticketing API.

  • Crosses from user-controlled text into retrieved content
  • Crosses from model output into write-capable tool path
  • Approval gate missing before customer-visible update

Permission matrix excerpt

Read: tickets and internal notes. Write: draft ticket update. Send: disabled. Execute: disabled. Delete: disabled.

  • Risk note: draft/write boundary depends on UI enforcement
  • Control note: require server-side deny for send and delete actions

Abuse-case matrix excerpt

Stored instruction in retrieved document attempts to override the agent's support workflow and call a ticket-update tool.

  • Expected behavior: quote retrieved text as data only
  • Observed behavior: unsafe draft generated without warning
  • Validation: replay after prompt and tool-gate remediation

Roadmap and appendix excerpt

Pre-launch: narrow tool scope and add approval logging. Post-launch: monitor rejected actions and review monthly prompt changes.

  • Appendix artifacts: sanitized trace, prompt excerpt, tool schema excerpt, config screenshot

01

What the sample demonstrates

Decision memo

A memo for leadership identifying launch blockers, pilot conditions, accepted residual risk, and next actions.

Findings register

A prioritized issue list with affected controls, likely impact, recommended fixes, validation methods, and tasks for the responsible engineers.

Maps and matrices

Trust-boundary map, permission matrix, and abuse-case matrix that make the system's real authority visible.

Appendix

Sanitized supporting artifacts such as transcripts, traces, configuration excerpts, screenshots, and test notes where they clarify the finding.

Limits

Scope and limitations.

  • The sample is illustrative. Your deliverables depend on the systems, access and decision agreed for the review.
  • No client names, customer data, secrets, or confidential materials are included.

Related paths

ApproachEnterprise buyer packetRequest written scope

Next step

Describe the system, question, and timing.

Request the sample package