Illustrative · orchestration · for the practitioner
We gave one helper the keys. The locked doors stayed locked.
Picture handing an assistant a key ring and letting it walk your whole building. It reads what it likes, checks what it likes, does real work in every room. Some doors have no key on that ring. Not because we asked it nicely to stay out. Because the building decides which keys exist, and it was never given those.
That is the whole story. The part people clap at — one assistant, working across four different systems, from a chat window — is the easy part. Plenty of tools do that. The part that matters is the doors it could not open, and being able to show you why it could not.
The problem
An agent with broad keys is the newest insider risk, and most teams hand the keys over anyway.
What this demo proves
One agent runs this practice end to end through three narrow verbs, a kill switch, and no master key, and the locked doors stay locked.
The channel
It comes to you. You don’t go to it.
Nobody wants to learn another website. So the helper sits in the app you already have open — Slack at your desk, Telegram on your phone — and you just talk to it. It remembers what you said last time.
It runs on our own machine, not somebody else’s. That sounds like a detail. It isn’t: it means nobody outside gets a copy of what you asked. Everything further down this page happened in a chat window. Nothing was typed into a form.
The surface
Three things it can do. That’s the whole list.
The helper can ask the rulebook a question, read a score, and work out a new score. Ask, read, check. It can do those three things for every team in the company, which is a lot of reach. It cannot do a fourth thing, because there is no fourth thing on the list.
Here is the bit worth slowing down for. We didn’t tell it to behave. We built it so it can’t misbehave. Telling an AI “please don’t delete anything” is a wish. Never giving it a delete button is a rule. The app enforces the list, not the helper’s good intentions.
Ask the rulebook
You ask a rule in plain words. It finds the exact line in the official standard and shows you which line it was — or says “that isn’t in here” and stops.
It only ever sees the public rulebook. The private material is not in the room with it.
Read a score
It looks up a team’s score: how much AI they use, how well it’s watched, and whether that’s allowed yet.
Look, don’t touch. It cannot change a single thing with this one.
Work out a new score
You tell it what changed since last time. It redoes the sums and shows you the new score next to the old one.
It can add a new score. It cannot delete one, and it cannot touch who has access.
The run
One story, told six ways.
These look like six different tricks. They are not. They are six goes at proving the same one thing: the helper did real work everywhere, and never once stepped outside its list. Each stop below opens the page with the actual numbers on it.
01 · 2 min
Two dials and a gate
Start here, before anything is switched on. One dial: how much of the work AI now does. Other dial: how well anyone is watching it. The gate says the first must never get ahead of the second. Every number after this is read against that one idea.
How it works→02 · 8 min
Scoring a real team, from a chat message
It grades a security team against the real rulebook and says, out loud, “this team has gone further than its safety net — the gate is shut.” This is the only stop that teaches the idea rather than showing off a trick, so it goes first.
The worked team→03 · 8 min
Checking a thousand tools for booby traps
It lists what every tool can secretly reach, then looks for combinations. One tool that reads your files is fine. One that phones home is fine. The two together is not — and you only see that if you look at the whole pile at once.
How the scan works→04 · 10 min
Testing a real app made for children
A shipped app with a guard already on it. We measured the guard instead of trusting it, found it caught about half of the attacks, and improved the guard they had rather than selling them a new one.
The guard→05 · 7 min
Answering “am I allowed to do this?”
Someone asks a rule in their own words, in their own language, and gets the actual line from the actual rulebook back. If the rulebook doesn’t say, it admits that and points at the person who decides.
The question everyone has→06 · 5 min
The close
Not “look, one helper drove four systems.” One helper went everywhere, did real work, and never once opened a door it wasn’t given a key to — and we can show you why it couldn’t.
The proof
It can’t make the score up.
This is the important one. When the helper tells you a score, it isn’t remembering it and it isn’t guessing it. It can’t. We never save scores — we only save the answers people gave, and the score gets worked out fresh every single time anyone asks.
So the helper is doing what a calculator does: handing you the answer the sum gives. Fix one thing in the real world, tell it, and watch the score go up and the gate swing open — live, in front of you. It has no way to hand you a nicer number than the truth, because it isn’t the one doing the maths.
An AI that could just declareyou were secure would make this whole thing worthless. That is exactly why it can’t.
The answer
Sometimes the answer is: don’t use AI.
A score that only tells you that you’re behind is a score nobody thanks you for. So every reading lands on a list of everyday jobs — 13of them — and each job is measured by a number your team already argues about in its Monday meeting. Not “AI maturity.” Things like how long one alert takes.
Then comes the part nobody expects from people who work in AI. Each job lists the ways to make that number better, and nearly half of them — 19 of 39 — don’t involve AI at all. Write the runbook down properly. Script the boring half so a machine does it the same way every time, with no model anywhere near it. Train someone. Change a rule. The other 20 reach for a model, and they have to earn it.
We would rather tell you to rewrite a runbook than sell you a robot that guesses. If the cheapest fix isn’t AI, that’s the one on the list.
And when you do want the AI to run a job on its own, the job tells you the exact controls you need first. Not a warning. A list, with the names of the things to go and do. That is the gate again, except now it is a shopping list instead of a red light.
The tools
We didn’t build a single one of these.
Here is the awkward bit for us. The tools that do the actual testing are not ours. They are free, they are famous, and your team can download every one this afternoon — Garak, PyRIT, Promptfoo, SkillGuard, and the rest.
They come in three kinds, and the three kinds are the whole idea: 14 that attack your AI to see what breaks, 3 piles of nasty examples to attack it with, and 5 that stand in the way and block the bad thing. Attack it, know what to attack it with, block what gets through.
So what do we do, if we didn’t build the tools? We answer the only question that is actually hard: which one of these answers which rule. Anyone can hand you a list of famous tools. Knowing that this tool is the evidence for that line in the standard is the whole job, and it is the only thing on this page we would ask you to pay for.
The boundary
The doors with no key.
Anyone can tell you what their AI can do. That list is easy and every vendor has one. Ask for the other list — the things it can’tdo, and who decided — and the room usually goes quiet. Here is ours.
It cannot run commands on a computer.
We switched that off. It can think, and it can use the three things on its list. It does not get a machine to drive. Most of the scary AI stories start with someone leaving this on.
It cannot see the private material.
The valuable stuff — the full tool list, the mapping we sell, the paid rulebooks word-for-word — is simply not handed to it. Same as a stranger on the website. It roams widely because there is less to find than you would think.
It cannot delete anything, or add anyone.
Those buttons exist. They belong to a human. A helper with big reach is fine as long as the dangerous verbs were never on its list in the first place.
It is switched off until someone switches it on.
Out of the box the doors do not open at all, and one flag closes all three again instantly. Shipping it changes nothing until a person decides otherwise.
And the honest bit.This helper is our own back-office tool. It isn’t for sale, and you would never depend on it. We show it because it is the same argument we make about the AI already loose in your own teams, just where we can prove it: let it do a lot, and make sure what it can do never gets ahead of what keeps it honest.