AI systems now hold real permissions. They warrant real review.
Independent examination of the models, agents and data paths attached to your technology — under a written scope, with a named analyst.
A conventional assessment was not designed for a model that can act.
A language model that reads company documents, answers staff questions or calls business tools is no longer a demo. It is part of the control environment. Prompt injection, over-broad retrieval, shared credentials and unreviewed tool access are the usual failures — and they do not show up as a missing patch on a scanner report.
AI assurance is the same Forensic Five engagement model applied to that stack: written authorization, a named analyst, findings with evidence, and a statement of what was out of scope. It can stand alone or sit inside an audit, a test or an enterprise review.
Client material provided for a review is never used to train or tune any model. That is a term of the engagement, not a preference.
What we examine.
The brief names which layers are in scope. We do not imply that an untested layer was reviewed.
I · Inputs and content
What the model is allowed to read
Chat, files, email, tickets and web content can be used to steer a model. We look for injection paths, untrusted content reaching privileged prompts, and whether staff can tell a model instruction from ordinary text.
II · Tools and agents
What it can do, and as whom
Agents that send mail, query systems or change records need the same authorization rules as a person. We record which tools exist, whose credentials they use, what constrains them, and whether a failed or unexpected action is logged.
III · Data and context
Retrieval, memory and retention
We review what is retrieved into context, what is stored as memory, who can see logs and transcripts, and whether sensitive material can leave the intended boundary. Training and fine-tuning data is in scope when you supply it or when a vendor retains it.
IV · Models and hosting
Where it runs, and who can change it
Provenance of the model, the host, the region, and who can alter prompts, tools or weights. Vendor terms, subprocessors and whether your content is used to improve a third-party model are documented when they can be established.
A written opinion, not a product endorsement.
Work begins with an introductory meeting, then a scoped review. We may interview operators, read architecture and prompt design, inspect retrieval and tool configuration, and — where authorized — attempt to abuse the same paths an outsider or an insider would use.
The report states method, coverage and limits. If we did not test a layer, the report says that. Recommendations are not tied to a product we sell. If a control is good enough, we say so.
The same terms apply for clients internationally. Remote review is the default. On-site work is added only when the hosting or the evidence requires it.
Related practice
Audits cover the broader environment. Testing is authorized attack simulation against named systems, including agents. Context is for teams that train, tune and supply data to models.
What we will not claim
We do not certify a model as safe. We do not treat a vendor questionnaire as a substitute for looking at the deployment you actually run. We do not use your material to improve our own systems.
Discuss an AI review.
Tell us what the system does, who it can act as, and who has to read the findings. We reply with a proposed scope, timeline and fee.