Your agent framework has controls. Do they enforce your authority rules?

What we assess

• Agent actions, tools, data access, and consequential decision points
• The organisation’s delegated authority and approval rules
• Configured runtime, identity, workflow, and application controls
• Exception handling and human approval paths
• Evidence retention and decision lineage
• Adversarial misuse paths, including allowed-channel misuse

How the assessment works

We begin with the business authority that must hold: the action an agent may attempt, the authority required to approve, deny, or escalate it, and the control expected to enforce that rule. We then test the configured implementation through defined normal and misuse paths, and review the decision evidence retained.

What you receive

The final package documents the authority-to-control map, configured controls, test scenarios and observed results, decision lineage, and the practical work required to reduce material gaps. It provides a documented decision basis for the relevant governance and risk stakeholders.

When the agent runs on third-party AI

Provider evidence review records disclosures, testing access and transparency limitations. Where transparency is limited, AIRG paragraph 5.11 permits the institution to consider assessment by independent, competent parties. The institution retains primary accountability for its use of third-party AI.

We document compensatory tests, observed behaviour and residual risks. Where risk remains outside appetite, recommendations can include limiting or suspending the service, or replacing the provider.

Scope and limitations

The engagement provides an independent control assessment within the agreed use cases and testing access. It carries no certification, promise of MAS acceptance or regulatory compliance sign-off. The institution decides whether the evidence and residual risk support continued use.

What happens after assessment

Aivance can define remediation requirements and validate remediation evidence. Implementation is performed by the client’s internal teams or selected specialist partners unless explicitly agreed otherwise. The sequence is: Assess → Prioritise → Design → Implement with internal teams or specialist partners → Retest.