Authority exposure
How much real-world action the agent can take and how consequential those actions can become.
A five-minute, local-first diagnostic for organisations using AI agents, copilots or automated workflows. Map authority, exposure, boundaries, human control, observability and incident readiness.
Answer for one real AI system. If you are unsure, choose the weaker control. Uncertainty is useful evidence.
Control Debt = Exposure Index minus Assurance Index, floored at zero. Exposure measures consequence and reach; Assurance measures control strength.
Turn this self-check into evidence. We map the real permission envelope, test human authority, review observability and incident readiness, and give you a prioritised remediation plan plus an Assurance Receipt.
Founding offer is an independent readiness/assurance assessment, not certification, penetration testing, legal advice or a guarantee of safety.
For organisations that need evidence, not another questionnaire. We examine one real agent or workflow, map its permission envelope, test meaningful human authority, review observability and incident readiness, then give you a prioritised remediation plan and Assurance Receipt.
Independent readiness/assurance assessment. Not certification, penetration testing, legal advice or a guarantee of safety.
The diagnostic separates what the agent can reach or change from how well the organisation controls that authority. High exposure is not automatically unsafe; weak assurance is the problem.
How much real-world action the agent can take and how consequential those actions can become.
What sensitive, confidential or personal information the agent can reach.
Identity, least privilege, network and tool restrictions that constrain the agent.
Visibility, comprehension, time, authority, contestability and practical intervention.
Whether consequential actions, denials and tactic changes become visible quickly.
Whether the organisation can detect, contain, notify, learn and recover.
The free check is an indicative self-assessment designed to help prioritise questions. It does not independently verify your systems and should not be treated as legal, regulatory, cyber-security or certification advice.