# Agent controls: sample evidence dossier

Version: 2026-09-22. Author: Nick Cerutti.

**Synthetic demonstration.** No client information is used. This is a worked example of an evidence structure, not a completed client audit, certification or insurer-approved submission.

## Scope and inventory

Example agent `example-a` handles catalog requests for `example-tenant-a`.
Its allowed tools are `catalog.read` and `order.cancel`. Cancellation requires explicit approval. A test session has a hypothetical USD 0.10 remaining budget.
The sample evaluates authorization decisions in an isolated function. It does not execute tools, verify identities or maintain real balances.

## Control-to-evidence matrix

| ID | Control | Test | Expected result | Evidence |
| --- | --- | --- | --- | --- |
| AC-01 | Tenant boundary | Request for example-tenant-b | Deny | Cross-tenant test in reproduction output |
| AC-02 | Tool allowlist | Attempt shell.exec | Deny | Unlisted-tool test |
| AC-03 | Spend limit | Project USD 0.11 with USD 0.10 remaining | Deny | Budget-exceeded test |
| AC-04 | Human approval | Cancel without approval; then with approval | Deny; allow | Two cancellation tests |
| AC-05 | Useful allowed path | Authorized catalog read | Allow | Allowed-read test |
| AC-06 | Detect altered evidence | Change recorded outcome | Different digest | Hash comparison assertion |

## Reproduce

Download [reproduce-samples.mjs](https://nickcerutti.com/evidence/reproduce-samples.mjs) and run `node reproduce-samples.mjs` with Node.js 22 or later. The script has no dependencies or network access. It asserts six authorization outcomes and the digest comparison, and prints JSON. These are synthetic component tests, not Drako or Epica integration tests.

## Gaps a real engagement must close

- Identity: derive tenant and approval from authenticated server-side context; never trust the fields used in this toy input.
- Concurrency: reserve budgets atomically before execution; handle retries and idempotency.
- Approval: bind a signed, expiring approval to the exact action and verify the approver's authority.
- Logs: redact sensitive inputs; use access controls, retention and an externally anchored signature or hash chain. An unkeyed hash is not authentication.
- Operations: test actual kill switches, fail-closed behavior, bypass paths and recovery under load.
- Evidence: record environment, revision, operator, timestamps, artifact checksums, unresolved findings and reviewer sign-off.

## Engineering references

[Drako's versioned public implementation](https://github.com/drakolabs/drako/tree/23c9b64318043a09543c32c4e46070caf3ee530a) illustrates scanning and runtime controls. [Epica](https://github.com/angelnicolasc/epica) explores integrity and belief-revision mechanisms. These references do not establish compliance or acceptance by an insurer.

Discuss the concrete scope: https://nickcerutti.com/services/agent-insurability