First commercial engagement
Machine Authority Exposure Assessment
A paid, read-only enterprise engagement. It establishes what your AI agents and autonomous systems can actually do today, who is accountable for them, and what defensible evidence would exist if a consequential action went wrong.
Read-only · No enforcement change during assessment
Scope
What the assessment maps.
- AI agents and autonomous systems in operation or in pilot
- Accountable owners and sponsors
- Models, frameworks, skills, tools and MCP servers
- Available credentials and identities
- Reachable systems and data
- Consequential actions each machine could perform
- Overbroad or undocumented authority
- Missing approval, interruption, revocation and evidence controls
- Visible regulatory and assurance gaps
Method
Five stages, typically run alongside existing teams.
The engagement is designed to be low-friction: read-only, evidence-based, and shaped around the environments where consequence is highest.
- 01
Scoping
Agree environments, entities, jurisdictions and constraints. Confirm read-only access arrangements and data-handling expectations.
- 02
Discovery
Collect the machine-authority surface: agents, tools, MCP servers, service accounts, credentials, reachable systems and owners.
- 03
Analysis
Classify consequential capability, identify overbroad or unsponsored authority, and test where interruption, approval and evidence are absent.
- 04
Validation
Review findings with engineering, security, risk and audit stakeholders to confirm accuracy and operational context.
- 05
Reporting
Deliver the executive report, risk register, authority map, mandate model and phased plan.
Deliverables
What you receive.
Machine-authority inventory
A structured record of the machines operating in the estate, their sponsors and their reach.
Authority and dependency map
How authority flows between humans, agents, tools and systems, including delegation paths.
Executive exposure report
A board-readable statement of where consequential authority currently sits and why it matters.
Prioritised risk register
Findings ranked by consequence, likelihood and remediation effort.
Regulatory and assurance mapping
Where current practice supports or falls short of the control themes your obligations require.
Proposed mandate model
A first draft of purpose-bound mandates for the highest-consequence machines.
Phased containment and enforcement plan
A sequenced plan: observe, mandate, enforce at the highest-consequence boundaries, evidence throughout.
Intended buyers
Who commissions this.
Afterwards
What happens next.
- Findings are presented to executive and technical audiences separately, so each receives the level of detail it needs.
- The proposed mandate model can be adopted independently of CipherQuay; it is written to be useful on its own.
- Where an organisation wishes to proceed, the phased plan sequences observation, delegation and enforcement in the highest-consequence environments first.
- Eligible organisations may be invited into the private enterprise preview.
Pricing is not published. Scope, duration and fees are agreed in writing following a scoping conversation. The assessment is an advisory engagement: it is not an audit, certification, penetration test, or legal opinion, and it does not make an organisation compliant with any framework or regulation.