Skip to content
XS1
Work with XS1 Cyber

The agent is part of the attack surface.

An AI system with tool access is privileged infrastructure. XS1 Cyber treats it that way, with the same threat modeling applied to any component that can act on production — and reviews partners' agent systems against the sign-off sheet below before they go live.

Work with XS1 CyberContact

01 / The review

Bound the risk, then grant the access.

These are design rules, not guarantees — prompt injection is an open problem, and the point is to bound it. Before an agent system is given privileged access, it is signed off against this sheet, item by item.

Sign-off sheet8 criteria, each signed off before go-live
  1. 01

    Untrusted input, hostile tools

    Content an agent ingests is treated as untrusted data, never as instructions, and every tool is designed on the assumption that its input is hostile.

    CriterionThreat model covering ingested content, tool calls, and stored memory.

  2. 02

    Secret isolation

    Credentials live outside agent context and are designed never to appear in transcripts, logs, or model output.

    CriterionConfirmed secret isolation with no path into model context.

  3. 03

    Least-privilege execution

    Each capability is given the narrowest credential that completes the task, revocable on its own.

    CriterionLeast-privilege credentials issued per integration.

  4. 04

    Containment

    Execution is sandboxed on isolated workers, with capped inputs and enforced resource and time limits.

    CriterionSandboxing, input caps, and resource and time limits in place and tested.

  5. 05

    Auditability

    Every autonomous action carries an actor, a scope, and an outcome that survives the run.

    CriterionLogging sufficient to reconstruct any run after the fact.

  6. 06

    Model-layer evaluation

    Models are evaluated for dangerous-capability behavior and refusal calibration before deployment.

    CriterionDangerous-capability and refusal-calibration evaluations completed before deployment.

  7. 07

    Human approval

    Destructive and externally visible actions wait for a person.

    CriterionApproval gates on destructive and externally visible actions.

  8. 08

    Stop authority

    The system can be paused or revoked in production.

    CriterionA documented way to pause and revoke the system in production.

XS1 Cyber

Deploying agents with privileged access?

Describe the system and what it can touch. We reply within 1–2 business days to set up a review.

Work with XS1 CyberContact