Agent Access Review Available now
In two weeks, get an inventory of the agents acting in your environment, a map of what each can reach and under whose authority, and a fix plan your people own.
We map it from read-only exports. Nothing installed. You get a plan to close the access gaps we find.
Can you answer the question And the questions that follow
Agents are being turned on across the tools you already use. They act with people's access, and most teams cannot say what each one can reach or how to stop it. In two weeks, we can.
What you get
At the end of week two you receive a report, a full agent inventory and an evidence index. Every finding traces to the export rows it rests on. Where your records can't show something, the report says so and counts it as a gap, not as zero.
We run the review with your team, so every item has an owner before we leave.
The inventory, the access map and the plan, in your hands at the end of week two, with findings mapped to the access control and audit requirements CMMC examines.
The report, section by section
Where you standSections 1-2
Answers: Where do we stand?
You'll see: The answer in one paragraph and six numbers: agents found, agents unknown to security, agents with nothing limiting their changes, leavers whose agents kept working, agents that reached sensitive data, and gaps found.
Illustrative“61 agents found. Security knew about 22.”
Answers: The questions above, from your own records.
You'll see: Each question answered, marked Answered, Partly answered, or Can’t tell from your records.
Illustrative“Measured for 14 leavers. For 6, an agent or token kept working, from 9.5 hours to 59 days.”
What is thereSections 3-6
Answers: How many agents are running, and who owns them?
You'll see: Every agent by kind, whether security knew about it, whether it acts under its own identity or a person’s, what limits it, and who owns it.
Illustrative“12 coding agents on laptops. None approved, none known to security.”
Answers: Under whose authority does each agent act, and which agents start others?
You'll see: Chains from person to agent to sub-agent to what it reaches, with each link marked as seen in your logs or possible but not recorded.
Illustrative“A coding agent runs with the developer’s own access to the manufacturing database. Whether it starts sub-agents is not recorded.”
Answers: Do agents stop when their person leaves?
You'll see: For each person who left in the window, how long their agents and tokens kept working after their account was disabled, and why.
Illustrative“A cloud key on a departed analyst’s account was still in use 59 days later.”
Answers: When did an agent first reach your most sensitive data, and whose grant let it?
You'll see: For each system on your crown-jewel list, which agent reached it first, when, and through whose grant, or why your records can’t tell.
Illustrative“A widely shared drawings site let the tenant assistant return controlled drawings to a user who had never opened the site.”
What to doSections 7-10
Answers: What do we fix first?
You'll see: Gaps ranked by severity, each marked as a visibility gap (you can’t see what agents do) or a control gap (agents can do more than intended). Each has a fix using tools you already own, an owner and a date agreed at the workshop.
Illustrative“Disabling a person doesn’t reach cloud keys or developer tokens. Fix within 30 days. Owner: identity lead.”
Answers: What does this mean for our assessment?
You'll see: Each gap mapped to the CMMC Level 2 practices it bears on. This is evidence for your own readiness work. It is not an assessment, and AuthLN is not a C3PAO.
Answers: What’s left after we fix everything?
You'll see: The limits that remain with today’s tools: a limit on one agent doesn’t carry to the agents it starts, each system revokes access on its own schedule, and the record is kept by the systems the agent acts in.
Answers: How sure can we be?
You'll see: What was received, what didn’t apply, what wasn’t available, how records were linked across systems, and how your data was handled and deleted.
Examples are illustrative and drawn from a fictional sample report. Figures show the shape of each answer, not measured results. A full sample is available on request.
How it runs Two weeks
Before the two weeks
After you send
What we need from you
Your administrators export records and send us the encrypted files. We join them into one map of who delegated what to which agent, and what each agent then did.
A record that is missing, kept too briefly or editable is a finding, and so is a source you don't have.
Starts the two weeks. Users, groups and admin roles; leavers with exact cut-off times; connected apps and their consents; AI platform accounts and key IDs, never keys; and the 20-minute questionnaire, among others.
Within three working days of the start set, per system in scope. Service accounts and cloud keys, developer tokens and bots, agents built in business platforms, AI tools on employee computers, and cloud audit logs, among others.
Sharpens the map, not needed to start. Role and group changes, agent run traces, data labels and data-loss alerts, network traffic to AI services, and more.
Data handling
No passwords, API keys, tokens or connection strings. We need each credential's name, owner, scopes and last use. Remove any column holding a secret value.
We need who acted, when and on what, never the content itself. Drop prompts, message bodies and file contents.
We join records on user principal names, app and client IDs, and role names. To pseudonymize people, use one keyed hash (HMAC) across every export.
CSV or JSON as the system exports it, or a time-limited read-only audit role agreed at kickoff. The last 90 days for every source, 30 at minimum.
If anything is CUI or export-controlled, we can work inside your GCC High or GovCloud tenant instead, and only the report leaves (about two extra days).
We agree the channel and encryption at kickoff. We delete everything at the end and confirm it in writing.
Scope. One identity tenant (Entra ID, Okta or Google Workspace) plus the connected systems you pick at kickoff. Commercial, GCC High and GovCloud tenants count separately. HR, device and network inputs don't count as systems.
What it costs
Scope is agreed at kickoff: one identity tenant plus the connected systems you pick.
Pricing on request
Book a call and we will confirm scope and price for your environment.
Book an Agent Access ReviewAvailable now
From read-only exports, with nothing installed. You get an inventory, a delegation map, a fix plan your people own, and written confirmation that your data was deleted.
