Fixed-price review · 5 business days

Agent Security & Governance Review

Up to five agents and fifty tools. We answer the security questionnaire blocking your deal, mark every answer EVIDENCED, PARTIAL or GAP, and ship a signed pack your buyer verifies themselves.

Request this review — $1,500 50% deposit; balance on delivery.

Who this is for

A B2B SaaS or AI vendor whose enterprise customer sent an AI-agent security questionnaire and whose current answer is a paragraph of reassurance. The deal is waiting on evidence, not on features.

Typical trigger: “They asked for an agent inventory, how we stop data exfiltration, and whether a human approves destructive actions. We have partial answers.”

What you get

Questionnaire response pack

Nine buyer control requests answered against your actual implementation. Each marked EVIDENCED, PARTIAL or GAP, with the artifact that supports it.

Agent inventory + AIBOM

Every agent, model, tool and authority boundary we were given, exported as CycloneDX so the buyer can ingest it.

Signed evidence pack

Report and findings bound into a signed, hash-chained bundle with a standalone verifier and a pinned key fingerprint.

Remediation plan

The gaps ordered by risk and effort, with the smallest change that closes each one.

Scope

Included

Up to 5 agents, 50 tools, one tenant.
Identity, authority, delegation, approval and enforcement paths as implemented.
Runtime enforcement review: what blocks a call versus what only logs.
One round of clarifying questions and one revision.

Not included

Writing your security policy or your questionnaire answers for you.
Third-party attestation, SOC 2, ISO 27001, or a penetration test.
Continuous monitoring after delivery (separate retainer).
More than one tenant or business unit.

What we need from you

The questionnaire and the buyer's deadline.
Tool definitions and the policy/configuration that governs them.
A sample of decision records or logs, if they exist. If they do not, that is a finding, not a blocker.
A technical contact who can confirm what is actually deployed.

What this is not

A signed pack proves the record is intact and bound to the report. It does not prove your system is secure, and it is not an audit opinion. Gaps stay gaps: we do not upgrade an unobserved control to EVIDENCED. If your buyer requires a third-party attestation, this engagement will not satisfy that requirement and we will say so before you pay.

Request it

Send the questionnaire with the intake form. We confirm scope in writing before any payment.

Request the $1,500 review

Prefer email? vincent@firmeai.com