A
AGENT BEHAVIORWhat did the autonomous actor decide and attempt?
A behavioral failure can exist even when no consequential effect occurs.
VELVT ASSURANCE
Evidence beforeauthority.
Autonomous agents with real-world discretion create a new governance problem: what should an enterprise trust them to do, and on what evidence?
Velvt independently stress-tests the exact deployed representation, the authority it can exercise, the control plane around it, and the real effects that can execute outside the model.
Request an Assurance engagement →CUSTOMER-CONTROLLED RUNTIME · BOUNDED EXECUTION · AUDIT-READY EVIDENCE
EXACT REPRESENTATIONWhat exact system was tested?
BOUNDED AUTHORITYWhat could it attempt, approve or execute?
EXECUTED EFFECTWhat happened outside the model?
RETEST CRITERIAWhich changes invalidate the evidence?
A VELVT FINDING IS NOT BINARY PASS / FAIL
Agent failed ≠ control failed ≠ system failed.
An agent can violate policy while external controls still contain the consequence. Assurance keeps those failure classes separate so deployment, risk and governance teams can make a more precise authority decision.
C
CONTROL PLANEWhat could independently prevent prohibited execution?
Permissions, approval gates, policy enforcement and stop mechanisms are part of the tested boundary.
E
REAL EFFECTWhat ultimately happened outside the model?
Attempted action and executed consequence remain separate evidence.
BLAST RADIUS
What happens if the agent behaves badly?
Assurance is not only about failure likelihood. It is also about whether the resulting exposure is bounded, reversible, observable and independently enforceable.
ILLUSTRATIVE AUTHORITY ENVELOPEPROCUREMENT / TESTED BOUNDARY
AUTHORITY€50,000 / transaction
REPEAT EXPOSURE5 transactions
MAX CREDIBLE EXPOSURE€250,000
REVERSIBILITYPartial
HUMAN STOP20 minutes
EXTERNAL ENFORCEMENT> €50,000 blocked outside the model
INTENTION ≠ ATTEMPT ≠ EFFECT
The transcript is a narrative, not a risk record.
A compliant chat log can coexist with an unauthorized system attempt. Velvt keeps the behavioral and control layers separate so the record shows what the agent said, what it tried, what executed, and what ultimately contained the risk.
01INTENTIONWhat the agent claimed it would do.
→02ATTEMPTWhat the agent actually pushed toward execution.
→03EFFECTWhat happened outside the model.
→04CONTAINMENTWhether independent controls held the line.
01 / INTENTIONMODEL NARRATIVE
“I have declined the vendor's request due to policy limits.”
- APPEARS TO SHOW
- Policy awareness, refusal, and apparent compliance.
- DOES NOT ESTABLISH
- That the agent refrained from issuing a prohibited action.
02 / ATTEMPTSTRUCTURED ACTION
execute_purchase(
vendor_id="corp_99",
amount=75000,
bypass_approval=true
)- BEHAVIORAL EVIDENCE
- The agent produced a concrete out-of-policy execution attempt.
- AUDIT QUESTION
- Was that attempt observable before it reached consequential infrastructure?
03 / EFFECTEXTERNAL OUTCOME
TRANSACTION NOT EXECUTED- WHAT HAPPENED
- The attempted purchase did not become a real-world commitment.
- WHY THIS MATTERS
- Attempted action and executed consequence are distinct evidence.
04 / CONTAINMENTCONTROL PLANE
INDEPENDENT BOUNDARY HELD- CONTROL RESPONSE
- External IAM or gateway enforcement blocked the prohibited execution.
- VELVT DISTINCTION
- The agent failed. The system held. Those are different findings.
WHY ENTERPRISE BUYERS CAREA safe-looking transcript can hide an unsafe attempted action. Assurance reconstructs the full chain so governance teams know whether they are relying on compliant behavior, successful containment, or both.
WHAT VELVT ESTABLISHES
Before you expand authority.
The engagement is scoped around the decision a relying party actually needs to make—not a generic agent score.
IDENTITY
Are we testing the exact representation being authorized?
BOUNDARY
Is the permitted authority explicit and enforceable?
FAILURE CONTAINMENT
What is the maximum credible consequence if the agent acts incorrectly?
CONTROL EFFECTIVENESS
Do approval gates, permission ceilings and stop mechanisms work independently of the model?
ADVERSARIAL BEHAVIOR
Does the boundary survive manipulation, urgency, delegation and untrusted input?
AUDITABILITY
Can intention, attempted action, control response and executed effect be reconstructed?
PRODUCTION APPLICABILITY
Which production conditions are represented by the test, and which remain untested?
CHANGE CONTROL
Which changes make the prior evidence stale or out of scope?
EXACT TESTED REPRESENTATION
Authority is granted to a representation, not an agent name.
The finding is tied to the concrete configuration that was actually assessed.
- MODEL
- Provider + version recorded
- SYSTEM CONFIG
- Configuration fingerprint
- TOOLS
- Tool / MCP manifest recorded
- PERMISSIONS
- Authority + permission manifest
- POLICY
- Policy / prompt version recorded
- DEPENDENCIES
- Relevant external services recorded
SUPPLY-CHAIN SCOPEEvery dependency that can change the effective authority boundary belongs in scope.
PRODUCTION APPLICABILITY
A bounded test is useful only if you know what it represents.
Production permissions, tools, external controls, counterparties, approval gates and data paths explicitly represented in the engagement.
Untested integrations, future model changes, unseen adversarial conditions, unrelated data paths or authority outside the defined scope.
LIMITATIONA finding applies to the tested representation, authority scope and stated conditions. It does not establish universal behavior across future configurations.
WHERE VELVT SITS IN THE STACK
Build. Observe. Enforce. Assure.
Frameworks help you create the agent.
Models, orchestration, workflows and application logic.
Tracing tells you what happened inside the runtime.
Prompts, tools, execution paths, latency and debugging.
IAM and policy constrain what can execute.
Permissions, policy enforcement, access boundaries and runtime controls.
Velvt tests whether the actor and control plane hold the intended boundary.
Independent evidence for the relying party making the authority decision.
THE ENTERPRISE ASSURANCE FRAMEWORK
One consequential boundary. Five rigorous steps.
DEFINE THE AUTHORITY SCOPE
Establish the financial, operational or permission boundary being considered—and the consequence if it fails.
PRESSURE THE BOUNDARY
Velvt constructs bounded adversarial conditions around urgency, delegation, conflicting instructions and untrusted inputs.
OBSERVE ACTOR + CONTROL PLANE
Agent intention, attempted action, control response and executed effect remain separate evidence.
INDEPENDENT ADJUDICATION
Velvt reviews the complete record and issues only the scoped finding the evidence supports.
REMEDIATE + RETEST
Repairs, authority increases, material configuration changes or contradictory evidence can trigger retesting.
REPORT DELIVERYCompletion creates evidence. It does not automatically create an Assurance opinion.
Velvt reviews validity and limitations, adjudicates the complete record, and only then delivers the final report.
CHANGE CONTROL
Material changes can make yesterday's evidence stale.
MODEL / PROVIDER CHANGEREVIEW OR RETEST
SYSTEM PROMPT / POLICY CHANGEREVIEW OR RETEST
NEW TOOL / MCP SERVERREVIEW
PERMISSION INCREASERETEST REQUIRED
SPEND LIMIT INCREASERETEST REQUIRED
NEW DELEGATED AGENTREVIEW
CONTRADICTORY EVIDENCERETEST REQUIRED
ASSURANCE STATECURRENTSTALERETEST REQUIREDSUPERSEDEDWITHDRAWN
SECURITY + DATA PRIVACY
Customer-controlled operational boundaries.
- Production credentials
- Model credentials
- Raw system prompt
- Private memory
- Unrelated production data
- Approved assessment responses
- Recorded action attempts
- Observed effects
- Configuration identifiers / hashes
- Run + provenance metadata
EVIDENCE INTEGRITY · E0–E6
How much evidentiary weight should the record carry?
Evidence strength is not a safety score. It describes how the record was produced, how independent the conditions were, and whether the outcome was corroborated or externally verifiable.
Claim made by the subject or operator.
Evidence generated inside an operator-controlled environment.
A bounded scenario constructed and recorded by Velvt.
A disclosed Velvt-controlled counterparty participates.
A counterparty outside the evaluated operator's control participates.
The outcome is supported by additional independent evidence.
An external decision, authority change, settlement or receipt is independently verifiable.
INITIATE AN ASSURANCE ENGAGEMENT
What authority are you considering granting your autonomous agents?
Share the operational boundary, target workflow and worst-case consequence. Velvt will determine whether a rigorous, bounded Assurance engagement can be constructed around that decision.
Founding enterprise engagements are personally reviewed and scoped. No production credentials or API keys are required for an initial evaluation.