Agent Governance Readiness Assessment
Our main way in. A fixed-scope engagement designed to show which agents you run, who owns them, what they can reach, where policy and practice differ, and what to tell the board. More
Services
Governance for AI agents, through their lifecycle.
One clear service for each moment that matters: when the board asks, when you buy, before go-live, while agents run, and when an auditor wants proof. Every engagement is designed to be independent and read-only.
Where to start
Our services.
Board and executive AI agent risk briefing
A plain-language session for directors and executives on what AI agents mean for risk, oversight and accountability, and the questions to ask management.
AI vendor and MCP due-diligence review
Before you buy or connect an AI agent, vendor or MCP server, an independent look at what it would be able to reach and on whose credentials.
Pre-go-live readiness check
An independent check that an agent is ready for production and its access matches what was approved. We check readiness; we never implement.
Ongoing agent access and drift review
A recurring review of each agent against what you approved, so new access, new tools or a changed model don’t go unnoticed.
Board and audit-ready reporting
Evidence organized for your board, audit committee and auditors, mapped to NIST AI RMF and ISO/IEC 42001. Never a claim of compliance.
AI vendor exit-readiness review
A review of how dependent you are on each AI vendor and how ready you are to switch or step away.
One shared view of agent risk
Our own tooling, in development, designed to give security, risk and IT leaders one shared view of agent risk, and to keep the evidence current between reviews.
What it isn’t
Clear about the edges.
- We don’t build, operate or implement agents, and we don’t block traffic.
- We don’t write your policies for you. We help you show whether they hold.
- Not a certification, an attestation or a compliance score.
- Not a change to your systems. Every engagement is designed to be read-only.
Find the right first step.
Tell us what prompted the question: a board meeting, an audit, a new vendor or an incident. We’ll suggest where to start.