HomeServicesAgentic AI Containment Assurance
Independent technical assurance
AI agents do not just answer — they act. They run code, call APIs, modify systems, and carry out multi-step work with real permissions. Agentic AI Containment Assurance is an independent, tested answer to one question: what can this agent reach, change, disclose, authorize, or damage before your organization can stop it? Containment is not an architectural claim — it is a security property that has to be demonstrated.
The problem
When software can act, the security question changes. It is no longer whether the model usually follows instructions — it is what the complete deployed system can do when the model is manipulated by untrusted content, encounters a misconfigured tool, or pursues an objective beyond its intended boundary.
"Sandboxed," "human-in-the-loop," and "read-only" are useful design intentions. A sandbox may still have an egress path, a nominally read-only tool may invoke a side-effecting API, and an approval step may take longer than the agent needs to create an irreversible consequence.
We assess the agent together with its orchestration, system instructions, tools, identities, credentials, network paths, memory, retrieval sources, data stores, logging, approval mechanisms, infrastructure, and external services — not the foundation model in isolation.
Averages conceal catastrophic weaknesses. Strong logging does not compensate for unrestricted production credentials, and good model behaviour during a demonstration does not compensate for an ineffective shutdown mechanism. Findings are reported by dimension.
The framework
Four exposure dimensions describe what the agent could do — its consequence space. Two containment-capability dimensions describe whether you can see that behaviour and stop it. The distinction matters: exposure tells you what is at stake, containment capability tells you whether oversight is operationally real.
Exposure
What actions can the agent take? From read and recommend through write, execute, externalize, and authorize. Assurance documents both intended authority and technically available authority — any difference is a finding.
Exposure
Where can the agent reach? Browsers, APIs, webhooks, package repositories, cloud metadata endpoints, messaging, MCP servers, and agent-to-agent channels. Restrictions are tested, not inferred from configuration documentation.
Exposure
What authority can credentials convert into action? Service accounts, API keys, tokens, cloud roles, repository rights, and administrative functions — including secrets discoverable through environment, logs, volumes, or metadata services.
Exposure
Can the effect survive the session? Files, configuration, scheduled tasks, accounts, tokens, repository changes, memory entries, callbacks, deployed workloads, and altered startup behaviour. Ending a session does not prove containment.
Containment capability
Can consequential behaviour be reconstructed? Independent, attributable records of tool use, authorization decisions, and external communication — held outside the agent's control, where they cannot be suppressed, altered, or bypassed.
Containment capability
Can the organization stop the agent in time? Session termination, credential revocation, network isolation, process termination, tool disablement, and deterministic policy enforcement — measured against how fast the consequence arrives.
Control principle: the model should not be the final authority on its own permissions, approval requirements, compliance status, logging, or right to continue operating.
The measures
The assessment converts technical testing into measures a board can act on — without collapsing distinct weaknesses into a single average.
Each exposure dimension is scored 0–4 and reported as a profile rather than an average, so the shape of exposure is preserved. Significant authority combined with significant privilege is the combination that turns a model error into an operational consequence.
MCAI (A0 Informational through A4 Critical) answers the executive question: what is the most consequential credible outcome this agent could produce before existing controls detect and stop it? It is rated on technically available pathways, not average routine behaviour.
Intervention Time (detect + decide + enforce) is compared with Damage Time (the shortest credible path to a material consequence). A margin below 1 means the consequence lands before intervention completes — and monitoring faster is usually not the fix.
A worked example of why the margin matters: suppose testing shows that a manipulated input can drive an agent to overwrite a shared record in 20 seconds, while your alert-to-intervention path takes 45 seconds. The Containment Margin is 20 / 45 ≈ 0.44 — the damage is done before anyone can act. For that action class the remediation is not faster monitoring; prevention has to move ahead of the model, through versioned writes, constrained destinations, or deterministic approval before the action executes.
The evidence standard
A design diagram, a policy statement, or a vendor questionnaire is not equivalent to an independently challenged control.
Repeatability matters: agent behaviour is probabilistic. A single successful run does not prove reliability, and a single failed adversarial attempt does not prove security. Critical scenarios are repeated, and configuration, prompt variation, repetition count, and observed success frequency are recorded.
How it works
Scope and duration are scaled to the agent's authority and the sensitivity of the environment. All adversarial testing is authorized, bounded, and agreed in writing before it begins.
Define the agent, tools, identities, data, network, environment, and people. Output: assurance boundary and agent authority map.
Identify credible manipulation, misuse, failure, and boundary-crossing scenarios. Output: a prioritized scenario register.
Inspect architecture, IAM, network rules, secrets handling, approval flows, logs, and incident processes. Output: control evidence inventory.
Conduct authorized adversarial and failure-mode testing — including prompt injection, tool misuse, credential discovery, and approval bypass.
Measure behavioural variability and alternate pathways across repetitions. Output: repeatability results.
Test stop mechanisms and scenario timing. Output: Intervention Time, Damage Time, and Containment Margin.
Classify findings and decide deployment posture. Output: an executive report with a clear deployment recommendation, and a sequenced remediation roadmap that converts findings into an implementation plan.
What you receive
Why it matters for executives: autonomy is delegated operational authority. Governance should scale with the authority delegated to the system and the irreversibility of its potential effects — a text summarizer and an internet-connected code-execution agent should not face the same approval process.
Production gate
Within the assessed scope, Maple Quanta would normally recommend against production deployment while any of the following is present. Exceptions should require explicit, documented risk acceptance by an accountable executive, with residual risk and compensating controls stated.
Buyer's checklist
Procurement should treat autonomy as delegated operational authority. Before an agent is bought or approved, ask for evidence — not assurances — on these ten questions. The assessment exists to answer them independently.
If the answers are assurances rather than evidence, that is exactly the gap this assessment closes — independently, before the contract is signed or the agent reaches production.
Alignment and limits
The framework is built to sit alongside the NIST AI Risk Management Framework and TEVV work, Canadian Centre for Cyber Security and international guidance on the careful adoption of agentic AI, OWASP's agentic security material, and ISO/IEC 42001, 23894, 42005, and 42006. Its contribution is to translate those principles into a compact system-containment model with measurable, executive-facing outputs.
It is not a certification scheme and does not certify conformity with ISO/IEC standards. It does not prove that an AI system cannot fail, and it does not replace a formal penetration test, privacy assessment, safety case, or regulatory assessment where those are required. Conclusions are configuration-specific: they apply to the model version, prompts, tools, permissions, environment, and controls assessed, and material changes trigger retesting.
The full methodology — framework, metrics, evidence model, and decision rules — is published in the Agentic AI Containment Assurance white paper (Version 1.1, August 2026). Detailed adversarial test scripts, scoring calibration, assessor procedures, and client-specific tooling remain part of the engagement rather than the public document.
Control is not the claim that nothing will go wrong. It is the demonstrated ability to intervene, exit, and recover when it does.
