Map every tool and integration
List every tool the agent can invoke, every data source it can read, and every system it can write to. Include indirect access through tool chaining.
Audit framework
How to Audit an AI Agent System
A five-phase audit framework for governance and risk teams evaluating production agent systems. Each phase answers a specific question about the agent's capabilities, controls, and failure modes.
AudienceSecurity, governance, and risk teams
ScopeAutonomous AI agents with tool access in production
GoalDetermine whether the agent's actions are observable, containable, and aligned with policy
Phase 1
Inventory agent capabilities
Before evaluating controls, the auditor needs a complete inventory of what the agent can do. This is the foundation of every subsequent phase.
Document authentication scope
For each integration, document what credentials the agent holds and what those credentials can access. An agent with a service account that has broad permissions may have access far beyond what the tool inventory suggests.
Identify read vs write operations
Categorize every capability as read-only, write, execute, or administrative. The ratio of write to read operations is a useful signal of overall risk posture.
Phase 2
Map blast radius
For each capability identified in Phase 1, determine the worst-case outcome of a compromised or misused tool call.
Single-call blast radius
What can one tool call achieve? A single API call to a file server could read a project's entire document store. A single database query could dump a user table.
Chained-call blast radius
What can the agent achieve by sequencing multiple tool calls? A read followed by a write could exfiltrate and delete data. A search followed by an API call could identify and exploit internal services.
Credential exposure radius
If the agent's credentials are compromised through prompt injection or session hijacking, what systems become accessible? Map the credential chain.
Phase 3
Review policy enforcement
Examine what enforcement mechanisms sit between the agent's intent and its actions. The goal is to distinguish between advisory controls (suggestions the agent can ignore) and deterministic controls (actions the system can enforce).
Prompt-level controls
System prompts and instructions that tell the agent what to avoid. These are advisory — a prompt injection can override them. They should not be the primary security boundary.
Tool-level controls
Argument validation, schema enforcement, and allow/deny lists that operate at the tool boundary. These are deterministic — they evaluate the actual tool call, not the model's intent.
Execution-level controls
Runtime policy enforcement that evaluates the tool call, the session context, and the policy before allowing execution. VEX Protocol and similar execution governance frameworks operate at this layer.
Phase 4
Verify audit trails
An agent system without durable audit trails cannot be audited in any meaningful sense. The auditor needs to confirm that logs exist, are tamper-resistant, and contain enough context to reconstruct what happened.
What was requested
Logs must capture the full tool call including arguments, not just the tool name. Argument-level logging is what makes incident response possible.
What was allowed
For every call, the log should record which policy rules applied and whether the call was allowed or denied. This turns a security incident into a policy review.
What actually executed
If the call was allowed, the log should include the response, any side effects, and timing data. This closes the loop between intent and outcome.
Phase 5
Test failure modes
The final phase tests whether the controls identified in Phase 3 actually work under adversarial conditions.
Prompt injection tests
Inject adversarial instructions into content the agent is allowed to read. Verify whether the agent attempts tool calls that violate policy, and whether those attempts are blocked at the tool or execution level.
Argument boundary tests
Submit tool calls with arguments that are technically valid but semantically dangerous — paths to sensitive files, unusually large payloads, unexpected combinations of parameters.
Delegation tests
If the agent can delegate tasks or call other agents, test whether a restricted action can be routed through an agent or tool that operates under weaker policies.
Close the loop with execution governance
The VEX Protocol provides a deterministic execution governance layer that makes audit results actionable. Deploy policy enforcement that matches the controls identified in your audit.