Frame the decision
Define the launch, customer commitment, or architecture decision the evidence must support.
Signature GenAI assessment
Verify whether effective agent authority matches the intent.
Agent Authority is the signature focused engagement within the GenAI Security Assessment service area. It tests whether a production-bound agent stays within the authority intended for the right user, tenant, delegated task, tools, APIs, credentials, actions, and destinations. The exact boundary, schedule, delivery team, outputs, and fee are tailored to the client and documented before work begins.
Engagement designTailored
Commercial terms, timing, and scope limits are defined in the tailored proposal.
Qualification determines whether the work should be a readiness review, active verification, focused authorization assessment, remediation retest, or another bounded scope. A signed proposal and agreement define the work.- Decision
- The release, customer commitment, architecture choice, or risk question the work must support
- System boundary
- The applications, agents, APIs, network segments, identities, cloud services, email and endpoint controls, approved facilities and zones, participant populations, critical assets, and dependencies included
- Environment + access
- Representative environments, approved identities, domains, populations, systems, sites, data constraints, production parity, facility authority, and available evidence
- Test depth
- Critical assets, roles, tenants, threats, attack paths, simulated messages or behaviors, physical-control scenarios, control seams, and required manual validation
- Deliverables
- Technical evidence, executive decision support, customer-shareable material, working sessions, workshops, and reporting needs
- Follow-up
- Remediation support, retest boundary, timing constraints, and any agreed closeout work
What it answers
Does assembled behavior preserve the authority your team intended?
The work begins with the important allowed and prohibited paths. It then evaluates whether application logic, agent orchestration, identity, API controls, credentials, tools, and downstream systems preserve those boundaries when assembled.
Prompt injection, indirect prompt injection, parameter manipulation, retries, fallbacks, alternate destinations, and state transitions may be used where they help answer the authority question. They are methods—not the whole category being sold.
The evidence record identifies production-parity assumptions, unavailable paths, environmental differences, and anything the approved assessment cannot establish.
Engagement sequence
A controlled path from intent to observed evidence.
Map intended authority
Document actors, tenants, delegated tasks, identities, tools, destinations, credentials, and allowed actions.
Verify observed behavior
Exercise approved allow-and-deny paths, capture evidence, and investigate discrepancies without expanding scope by implication.
Close the decision
Deliver the agreed engineering evidence, decision support, remediation priorities, and retest record where included in scope.
Active testing starts only after qualification, written authorization, access readiness, evidence rules, escalation contacts, and stop conditions are complete. Schedule and any retest window are stated in the signed engagement documentation.
The client remains responsible for launch, risk acceptance, compliance, and business decisions. LuxlyNight provides bounded technical evidence and recommendations within the signed scope; it is not certification, legal advice, compliance attestation, or a guarantee of security.
Client prerequisites
What needs to be ready.
- A named system owner and accountable decision-maker
- A customer-controlled environment suitable for the approved work
- Approved test identities for the relevant users, roles, services, and tenants
- A high-level statement of intended authority and known approval boundaries
- Technical contacts for the application, identity, agent, and downstream systems
- An agreed test window, escalation path, stop conditions, and evidence rules
Explicit exclusions
What this assessment is not.
- Unbounded enterprise-wide red teaming
- Continuous monitoring, SOC, MDR, or managed detection
- Emergency incident response or around-the-clock availability
- Model-alignment, bias, or content-safety certification
- Compliance attestation, legal opinion, or security guarantee
- Production testing unless it is expressly authorized in the signed scope
Qualification
Check whether the GenAI agent-authority assessment fits the decision.
The fit check is anonymous and stays in your browser. No target or sensitive information is requested.
Check engagement fit