An Agent Is a Loop With Your Permissions.
Agents plan, call tools, observe results and plan again. Every pass through that loop is a decision your controls either bound or do not. T3 finds where in the loop your controls actually attach, tests whether they hold, and builds the ones that are missing.
Book a Discovery Call See the control points
Aligned agent controls, embedded into delivery
Human oversight obligations met at the action layer
Of BigTech trust T3 with AI risk management
No commercial ties to the agent platforms we test
The Loop, the Graph, and the Control Plane
Most AI governance was written for a request and a response. An agent is neither. It is a loop that runs until it decides it is finished, and a graph of tool calls and handoffs that only exists at runtime. Controls that sit outside that loop do not constrain it.
Four Stages, Four Different Controls
Perceive, plan, act, observe. Each stage fails differently, so each needs a different control. A single approval gate placed at the end catches almost none of it.
- Perceive: context integrity and provenance
- Plan: least agency and tool allow-lists
- Act: scoped credentials and gating
- Observe: trace capture and evaluation
The Execution Path Only Exists at Runtime
An agent's actual path through tools, sub-agents and handoffs is a graph assembled on the fly. You cannot review a diagram drawn in advance, because the diagram is generated by the run.
- Delegation chains and sub-agent handoffs
- Tool call graphs, including MCP servers
- Replayable execution traces
Controls Belong Beside the Agent, Not Around It
Policy in a document does not intercept a tool call. Controls have to sit in the execution path itself, where they can deny, gate or halt an action before it lands.
- Deterministic guardrails at the tool boundary
- Circuit breakers and blast radius limits
- Kill switch that actually reaches the runtime
An Agent Is Not a Chatbot With Extra Steps
Every control you built for generative AI assumed a human read the output before anything happened. Agents close that gap. The failure modes below are specific to systems that act, and most governance frameworks do not address any of them.
Borrowed Identity, Full Authority
An agent running on a user's credentials inherits everything that user can reach. Least privilege designed for humans does not constrain a non-human actor operating at machine speed across a delegation chain.
Indirect Prompt Injection and Memory Poisoning
Agents read pages, tickets, documents and tool responses. Any of those can carry instructions the model treats as legitimate. Persistent memory makes it worse, because a single poisoned entry survives into every future run.
No Trace, No Reconstruction
Chat transcripts capture the conversation, not the spans: tool calls, arguments, records touched, sub-agents invoked. Without trace-level logging you cannot replay what happened, which means you cannot evidence it either.
Oversight That Degrades Into a Click
An approval a person confirms fifty times a day stops being oversight by the tenth. Human-in-the-loop has to be reserved for irreversible actions, with everything else moved to human-on-the-loop monitoring.
The hardest question about an AI agent is not whether it works. It is whether you can explain, afterwards, exactly what it did and why it was allowed to. T3 — AI Agent Assurance Practice
What Is AI Agent Assurance?
AI agent assurance is the discipline of bounding, testing and evidencing what an autonomous AI system is permitted to do, at the point in its execution loop where each action is actually taken.
It spans the non-human identity the agent holds, the least agency policy that decides which tools it may reach, the deterministic guardrails at the tool boundary, the adversarial testing that proves those guardrails hold, the trace and span logging that makes a run replayable, and the evaluation harness that catches behavioural drift between model versions.
It begins where AI governance stops being a documentation exercise and becomes an engineering one, aligned to human oversight obligations under the EU AI Act and the operational controls of ISO/IEC 42001.
Speak to a Specialist
The Six Pillars of AI Agent Assurance
T3's framework attaches a control to every layer at which an autonomous system can fail, from the identity it holds to the trace it leaves behind.
Agent Inventory & Blast Radius Mapping
Establish which agents exist, which tools and MCP servers they can reach, and how far a wrong action propagates. Shadow agents are counted, not assumed away.
- Agent register and ownership mapping
- Tool, connector and MCP server inventory
- Blast radius and reversibility scoring
Non-Human Identity & Least Agency
Give the agent its own identity with its own scoped credentials, rather than letting it borrow a user's full authority. Least agency extends least privilege to what the agent may attempt, not only what it may read.
- Agent identity and scoped credential design
- Tool allow-lists and capability boundaries
- Delegation chain and handoff constraints
Deterministic Guardrails at the Tool Boundary
Probabilistic systems need deterministic limits. Guardrails sit in the execution path and can deny, gate or halt a call before it changes state.
- Deny rules and irreversible action gating
- Input, output and tool argument validation
- Circuit breakers and runtime kill switch
Adversarial Testing of the Loop
Prove the guardrails hold under attack at every stage of the cycle: injection at perceive, tool misuse at plan, privilege escalation at act, poisoned feedback at observe.
- Indirect prompt injection and memory poisoning
- Tool abuse and chained escalation testing
- Reproduction steps with severity ratings
Human Oversight Calibrated to Consequence
In the loop for irreversible actions, on the loop for everything else. Oversight placed uniformly is oversight nobody performs.
- Consequence-based approval thresholds
- Escalation and intervention protocols
- Oversight effectiveness review
Observability, Evals & Replay
Trace-level capture of every span, paired with an evaluation harness that detects behavioural drift when a model, prompt or tool changes underneath you.
- Span and tool call logging specification
- Regression evals across model versions
- Incident replay and surveillance integration
The Vocabulary, Without the Hype
These terms turn up in every agent conversation and are rarely defined the same way twice. Here is what we mean by them.
Least agency
Least privilege extended from what a system may read to what it may attempt. The narrowest set of tools that still completes the task.
Blast radius
How far a single wrong action propagates before something stops it. The measure that should drive where you place approval.
Trace and span
A trace is one complete agent run. A span is one step inside it: a tool call, its arguments, its result. Evidence lives at span level.
Deterministic guardrail
A rule enforced in code rather than requested in a prompt. The model can be persuaded. The guardrail cannot.
Human in the loop vs on the loop
In the loop means the action waits for approval. On the loop means it proceeds and a human monitors. Consequence decides which applies.
Indirect prompt injection
Instructions arriving through content the agent reads rather than the user's message. The primary attack path against any tool-using system.
T3's AI Agent Assurance Process
A phase-gated engagement designed for organisations deploying agents into environments where a wrong action carries regulatory or client consequence.
Agent Discovery & Blast Radius Mapping
Establish which agents are live or planned, which tools, connectors and MCP servers they reach, and how far a wrong action travels. Includes agents adopted without central approval.
Identity, Guardrail & Trace Design
Design the non-human identity model, least agency policy, deterministic guardrails at the tool boundary, approval thresholds and span-level logging specification. Written to be implementable by your engineers, not aspirational policy.
Adversarial Testing & Remediation
Test the controls as an attacker would, at every stage of the loop. Indirect prompt injection and memory poisoning at perceive, tool misuse at plan, privilege escalation across delegation chains at act. Findings are rated and re-tested after remediation.
Evals, Monitoring & Continuous Assurance
Stand up the evaluation harness that catches behavioural drift when a model, prompt or tool changes underneath you, plus the review cadence that keeps controls current as agents gain capability. Agent assurance is not a point-in-time exercise.
Independent Advice. Engineering Depth.
T3 sits where policy meets engineering. We are not an agent platform vendor, and we hold no commercial relationships with the model providers whose systems we test.
We Helped Write the Standards
Contributions to the EU AI Act, ISO/IEC 42001 and NIST AI RMF. When an obligation is ambiguous, we know what it was drafted to achieve.
We Build the Control Plane, Not a Policy PDF
Where off-the-shelf GRC platforms stop, we build the deterministic guardrails, trace instrumentation and eval harnesses that sit in your execution path, fitted to your stack, your models and your regulator.
Regulated Sector Experience
Direct delivery in financial services, healthcare and the public sector, with the regulatory literacy to navigate FCA, MHRA and EU AI Act requirements in practice.
Agent Assurance Is One Part of Your AI Control Set
AI Inventory
Know what AI you are running before you govern it.
Runs alongsideAI Human Oversight
Meaningful oversight designed around consequence.
Deeper testingAI Model Assurance & Testing
Adversarial testing of the models beneath your agents.
ProtectsAI Data Security
Access controls for the data your agents can reach.
Ready to Prove Your Agents Are Under Control?
Book a no-obligation Discovery Call with a T3 agent assurance specialist. In 45 minutes we will map where your agents are running, identify your highest-consequence exposures, and outline a realistic path forward, specific to your organisation, sector and regulatory obligations.
Book a Discovery Call View All Services
No obligation. No sales pitch. A structured conversation with a qualified consultant. Typically responds within one business day.
- Which agents are live in your environment, including ones adopted without approval
- What those agents can reach, and under whose permissions
- Where your current oversight breaks down at machine speed
- Your regulatory obligations for autonomous systems, by sector
- A realistic engagement scope and timeline
