Agent Action Boundary Review (QA)

Agent Action Boundary Review (QA)

1. 01

   Inventory every security tool that can act on client systems without a human keystroke

   List each agent, scanner, or policy engine touching client infrastructure, the credentials it holds, and the systems it can write to. Include runtime governance layers such as Vaultak and autonomous remediation paths such as Cogent's VR-1 harness, since both can change state without a person in the loop.

2. 02

   Re-read the tool's instruction contract against the version approved at onboarding

   Model Context Protocol servers can silently alter the instructions an agent follows after sign-off, a drift condition documented on GitHub in October 2026. Diff the current instruction set against the stored approval snapshot before any client-facing run.

3. 03

   Confirm the kill switch and rollback path work under load, not just in the demo

   Trigger a deliberate policy violation in staging and time how long reversal takes. A governance layer that pauses actions but cannot reverse them leaves the agency holding the liability for whatever already shipped.

4. 04

   Score each finding by blast radius rather than severity label alone

   A leaked credential in a client repository scanner report outranks a theoretical dependency flaw if the credential opens production. Rank by what an attacker reaches in one hop, not by the vendor's default severity tier.

5. 05

   Verify the human approval gate sits before the irreversible action

   Publishing, payment, deletion, and outbound email need a named approver on the agency side. Anything reversible can run unattended; anything that reaches a client's customers cannot.

6. 06

   Log the review as a dated artifact the client can inspect

   Record tool versions, instruction hashes, test results, and approver names in one file per client per quarter. This log is the evidence base when a renewal conversation turns to risk.

7. 07

   Escalate any unresolved boundary gap to the account lead before the next delivery cycle

   An open gap becomes a written caveat in the scope document, not a verbal note. Promising absolute security is the one claim an agency cannot walk back after an incident.