AI agents can read documents, call APIs, update records and carry out actions on behalf of people. The risk is not just what the model says: it is what the connected tools permit the system to do. A useful pre-launch review follows those permissions and data flows before they become difficult to change.
Email about a readiness review → · Use the free readiness checklist →
Who this is for
- Teams piloting an AI assistant connected to CRM, email, documents or knowledge bases.
- SaaS developers adding tool-calling or AI-driven actions to an existing product.
- Agencies and automation consultants delivering client workflows using APIs, MCP servers or third-party services.
- Business owners preparing to move a useful AI proof of concept into real operations.
This service is most useful before an agent receives production permissions or begins taking external actions. A purely informational chatbot with no tools or sensitive data may not need a dedicated engagement.
What the review covers
| Control area | What we examine |
|---|---|
| Agent workflow and trust boundaries | Where instructions, retrieved documents, user messages and tool results enter; which sources are untrusted. |
| Prompt injection and instruction manipulation | Whether outside content could influence tool selection, user intent or privileged actions; review of designed boundaries, not a guarantee against attacks. |
| Identity and least privilege | Agent accounts, OAuth scopes, API tokens, per-user authorization checks, tenant isolation and unnecessary write/delete capabilities. |
| Sensitive data | Data passed to providers and tools, secret exposure, retrieval access, retention assumptions and output handling. |
| Connectors and third parties | MCP servers, plugins, external APIs, vendor access, approval processes and integration failure modes. |
| External actions and human oversight | Confirmations for sending, publishing, purchasing, changing records or deleting data; limits on autonomy and escalation. |
| Runtime controls and operations | Execution boundaries, timeout/rate/cost limits, logging, traceability, incident response and a way to disable the workflow. |
Where documentation allows, the review also discusses plausible misuse paths from untrusted input to a privileged operation. It does not claim that such paths have been exploited or comprehensively tested.
Entry-level review scope
One named workflow or agent with up to three connected tools or integrations, and one environment's documented access controls. The assessment uses supplied architecture material, a short live walkthrough, redacted configurations and representative non-sensitive traces where available.
Included: document and configuration review, permission inventory, trust-boundary analysis, control-gap assessment, practical remediation recommendations and a findings call.
Not included: intrusive or production penetration tests, autonomous attack campaigns, full source-code audit, formal compliance opinions, incident forensics, legal advice, model assurance, certifications or a claim that the system is secure.
What you receive
- Workflow and access map — the agent's purpose, key inputs, connected tools, data categories and privileged actions.
- Prioritized findings register — observed gaps, affected trust boundary, potential impact, evidence level and recommended owner/action.
- Remediation roadmap — changes to implement before launch, followed by sensible medium-term improvements.
- Written review and 30-minute handoff — a concise report and discussion to help the team decide what to address first.
A finding based on missing evidence is labeled not verified, rather than asserted to be a discovered vulnerability. This is a readiness assessment, not a pass/fail security stamp.
How an engagement works
- Scope: Share a brief description of the agent, the systems it can access, its actions and its deployment stage. Scope, price and confidentiality arrangements are confirmed before work begins.
- Walk through: Review the normal user path, tool catalog, roles and high-impact action boundaries using safe examples.
- Assess: Examine the supplied controls and evidence against the agreed checklist; rank potential consequences and practical fixes.
- Handoff: Receive the written findings and prioritized next steps. Implementation support is optional and separately quoted.
The initial review is usually scoped for 3–5 business days after suitable materials are available, depending on complexity and scheduling; timing is confirmed per engagement.
What to include in your inquiry
Email hello@360it.pro with the workflow's purpose, platform/framework (if known), number of tools/integrations, type of business data involved, any high-impact actions and whether the system is in prototype, staging or production. This is enough for an initial scope discussion.
Please do not email API keys, credentials, private customer data or confidential logs. Secure sharing arrangements can be established if later needed.
Methodology and reference sources
The review is informed by public guidance, not accredited or endorsed by the framework publishers. Relevant original sources include:
- OWASP Top 10 for Agentic Applications 2026 — agent-specific failure modes including goals, tools, privileges and trust boundaries.
- OWASP Top 10 for LLM Applications 2026 — LLM application risks and mitigation categories.
- OWASP Agent Control Standard (September 2026) — agent inspectability, traceability and runtime control.
- OWASP guide for secure MCP server development — authentication, authorization and tool-boundary concerns.
- NIST AI RMF and Generative AI Profile — risk management and governance context.
Ready to assess an actual workflow? Email a scope summary →
Common questions
Is this a penetration test or OWASP certification?
No. This is a bounded architecture, configuration and workflow readiness review. It does not include exploit development, comprehensive penetration testing, formal compliance certification or any OWASP endorsement.
Will you need access to our production environment?
Usually not. A walkthrough, architecture notes, redacted tool definitions and permission settings are generally sufficient for the initial assessment. Any further access must be expressly agreed and authorized.
Can a review cover multiple agents or sensitive production workflows?
The entry-level scope covers one workflow or agent and up to three connected tools or integrations. Multi-agent estates, broad infrastructure audits, regulated datasets and live adversarial testing require a separate scope.
Can you help fix identified issues?
Yes. Follow-up work on access controls, approval boundaries, logging, integration hardening and supporting infrastructure can be proposed separately after the findings are reviewed.