AI agent security: what your agent can reach alone

TL;DR An AI agent security review is an inventory of what your agent can reach on its own. We list every right it holds, cut each one down to the task it serves, put a person in front of anything irreversible, and keep a record of every action it takes. Week one costs $2,500.

Most teams do not have a clever attacker problem. They have an agent holding more access than the job ever needed, nobody able to say what it did last Tuesday, and a quiet decision somewhere to widen a setting so a task could ship on time.

What this includes

We treat your agent like a new member of staff on their first day: capable, quick, and holding exactly the keys the job needs and no others. The review produces a written list you can read in one sitting, and then we close the gaps in it, in the order that matters.

• The inventory: every system the agent can reach, every key it holds, every action it can take without asking anyone
• The minimum it needs: one key per task, limited to that task, and a written list of what it may never touch
• Where a person steps in: which actions stop and wait for an approval, and whose name is on that approval
• Prompt injection testing with the real text it reads, from product pages and supplier emails to the notes your own team leaves inside a record, lined up against the OWASP work on threats to AI agents
• The record: what the agent was asked, what it decided, what it did, and who approved it
• A stop button, rehearsed with you live, that halts the agent without throwing away work already queued
• A report ranked by what would hurt most, not by what is quickest to fix

This is the same access discipline we apply across our automation practice, narrowed to what one agent may touch. Miami teams tend to recognise it, because it is the rule they already follow, or meant to follow, on the systems we connect for local operations.

The review also says what it does not cover. We are not testing your whole company, and we certify nothing. What you get is the narrow, checkable answer an owner needs before an agent is given more work: what it can reach today, what it should be allowed to reach, and what happens the day it gets something wrong.

Where an agent gets more access than the job needs

Access does not widen in one decision. It widens on a Tuesday afternoon: a task is blocked, someone asks for the setting to be opened, it is opened, the task ships, and nobody closes it again. Repeat that a few times and the agent that was meant to read support tickets can also issue a refund.

The second cause is the opposite of laziness. Teams hand an agent one shared key because it is simpler to manage than one key per task, so the agent quietly inherits everything that key was allowed to do.

The third cause is the missing record. If nothing writes down what the agent did, nobody can answer the two questions that follow any incident: what did it actually change, and was that allowed. We have written before about why a hijacked agent reaches too far, and the short version is that reach is the problem, not intelligence.

Prompt injection protection sits on top of all three. Hidden instructions arrive inside the text your agent reads: a product description, a supplier email, a customer review. They only become an incident when the agent holds the rights to act on them. So we cut the reach first and test the wording second, and we test it against a plain-language account of how hidden instructions work rather than a vendor's checklist. The difference is worth an owner's attention: one approach reduces what a bad day can cost, the other only reduces how often a bad day starts.

When we rank what to fix first, the order comes from how much a single wrong action can cost you, not from how exotic the problem sounds. An agent that reads a delivery note and an agent that moves money both look like they are working; only one of them turns a mistake into a loss you have to explain to your accountant.

How it works

1. Discovery, 1 week, $2,500. We list every key the agent holds and every system it reaches, then try to talk it into things it should refuse, using the text it really reads. You finish the week with a map of what it can do alone and the two or three places where that reach is wider than the job.
2. Findings and plan, 1 week, $2,500, credited to the fix work. The list, ordered by what an incident would cost you, cheapest cuts first. This is also the week an AI compliance audit turns into evidence instead of opinion: the record and the approvals are what a bank, an insurer or a buyer asks to see, and the framework the federal government publishes is the reference we line that record up against.
3. Fixes, 4 to 10 weeks, from $5,000. Narrower keys, one approval gate in front of each irreversible action, the action record, and tests that fail loudly if a guardrail is removed six months from now.
4. Re-test and handover, 1 week, included. We run the same attempts again and show you, on your own screen, what no longer works and what still does.
5. Care, monthly, from $1,500. Re-testing when the agent gains a connection, a task, or a new person allowed to approve.

The fix phase is the one owners underestimate. Cutting a key is an afternoon; proving that nothing else depended on it takes the rest of the week, and that proof is the part that still holds when somebody asks you about it a year later.

None of this arrives as a slide deck. The evidence is the thing itself: the list of rights, the written note from a test attempt, the screen where an approval the agent could not bypass was waiting.

What it costs

Prices below are where each phase starts; your scoped quote fixes the exact scope, the price and the timeline.

Discovery is one week at $2,500, and the findings are yours whether or not you hire us to fix anything. The plan week is $2,500, credited to the build if you go ahead. Fix work is quoted per milestone from $5,000 over 4 to 10 weeks, so you can stop after the first milestone and keep what it produced. Re-test and handover, one week, is included in the build. Care is from $1,500 a month. How each phase is priced is published on the process page, in these same numbers.

What moves the figure up or down is visible before you commit: how many systems the agent reaches, whether anything irreversible runs on its own today, and how much of the record has to be built rather than switched on. An agent that reads and summarises is a shorter job than an agent that pays and orders.

There is no separate line for the report, because the report is the first two weeks. If the discovery week finds an agent that is already tighter than we expected, we will say so, and you keep the findings rather than a build you did not need.

Proof

We have not published an agent security engagement, and we will not pad this page with somebody else's incident report. What we can show is how we measure, and that habit travels: on every project we have published, the claim comes from a record rather than a feeling.

Food By Box runs 2,500 products. After its rebuild its speed rating from Google reached 95, monthly visits went from 20,000 to 500,000 across 24 months, and every address that carried traffic kept carrying it. Tatiana Miath's storefront went from just under five seconds to a little over one second on a mobile phone, and lost no rankings while it did. The numbers behind these projects are published in full, including the parts that took longer than we planned.

A speed rating is easy to argue about, because the number changes every week. Access is easier to check: either the agent holds the key or it does not, and either the approval was required or it was not. That is why we start there, and why the first two weeks end with something you can read, check and keep.

Michael Agnassia writes the architecture and reads the code before it ships, after 15 years in e-commerce. The studio is at 78 SW 7th Street in Brickell, Miami. We work in English and Spanish, remotely by default, and on site across South Florida when a project needs us there.

Questions

What does an AI agent security review actually check?

Four things: what the agent can do, what it is allowed to do, what it reads, and what gets written down when it acts. The gap between the first two is the finding.

Is prompt injection protection enough on its own?

No, and this is the mistake we see most often. Hidden instructions only matter when the agent holds the rights to act on them, so we reduce what it can reach before we argue about wording.

What does an AI compliance audit give us if we fix nothing?

A ranked list of what could go wrong, what to watch, and how often the agent acted without an approval. Most teams start with the action record and one approval gate: both are cheap, and both remove the worst outcomes.

Can we keep the agent we already run?

Yes. We look at what it can reach, not at how it was assembled. Access is narrowed without a rebuild, and if a rebuild were genuinely cheaper we would tell you that instead.

Who inside our company has to be involved?

Whoever owns the systems the agent touches, plus one person willing to hold the approvals. That is usually two people for an hour a day during the discovery week, and much less afterwards.

Do you need to be on site in Miami for this?

No. It runs remotely, and we travel across South Florida when a project needs it, in English and Spanish. If the agent turns out to be a symptom of something wider, the same two weeks can be spent looking further out.

Next

Start with the discovery week: one week, $2,500, and a written answer on what your agent can do alone and what it should never be allowed to touch. If the findings say nothing is worth fixing, we will tell you that and you keep the work. Owners who already know their agent reaches too far often pair this with the approval step we build for paperwork, and the quickest way to begin is to choose a time that suits you.