Authority boundaries
Can an agent exceed scope, use an unapproved tool, delegate broader permissions or act after revocation?
AI & agent assessments
An audit should show
what was tested.
We scope assessments around a real system, its decision boundaries and the evidence a responsible reviewer needs. Findings describe observed behaviour, control coverage and unresolved limitations.
Independent of the model
being assessed.
Legis Labs’ assessment proposition focuses on checking AI outputs and agent actions against evidence and explicit requirements. Independence is defined for each engagement: reviewer roles, financial interests and any involvement in building the controls are disclosed.
Where Legis Labs supplies part of a system, an assessment of that work is identified as a first-party evaluation unless a suitably independent reviewer performs it.
ASSESSMENT DELIVERABLES
- System boundary and approved test scope
- Threat model and control mapping
- Test cases, versions and observed outcomes
- Failures, limitations and remediation priorities
- Evidence references and retest conditions
An assessment is not a certification or a guarantee of regulatory compliance.
Assessment areas
Ask questions that
can be investigated.
Evidence and consistency
Can material claims be traced to sources, and can a reviewer identify gaps or conflicting information?
Adversarial behaviour
How does the system respond to prompt injection, tool tampering, forged approvals or repeated requests?
Operational accountability
Can a team reconstruct a decision, investigate an incident and apply a policy change without losing the record?
For banks and insurers
Evidence that supports
a decision.
Agree what a risk committee or underwriter needs to see before running the assessment.
Useful outputs connect a specific exposure to a control, show how the control was tested, and identify residual uncertainty. Insurance terms, regulatory acceptance and risk appetite remain decisions for the relevant institutions.
Read the assurance note ↗Work with Legis Labs
Scope a useful assessment.
Bring the workflow, the systems in scope and the decision the assessment must support.