Question bank · Identity boundary

Can an agent read one customer's data to another?

It can, whenever a lookup is scoped by an identifier the model supplies rather than one the verified session carries. The pattern is ordinary: a customer asks about "my other order," the agent puts an order number into a tool call, and the tool returns that order without checking who is asking. Everything else about the agent can be correct and this one path still ends a review. It is the highest-severity class because no attacker is required — an ordinary customer typing an ordinary sentence is enough.

01

Enforcement

Where is the identity boundary actually enforced?

In the query layer or not at all. The safe shape is that every read filters on a tenant and customer identifier carried by the authenticated session, and the tools ignore any identifier the model produces. Our published example profile states it that way — "order and customer queries filter on the merchant_id and customer_id carried by the session, not on identifiers supplied by the model" — and then, in the same file, marks whether other customers are reachable as "uncertain," because one surface resolves identity from an unverified email address. Both halves of that are the honest answer.

01Scoped by the sessionThe identifier comes from an authenticated session. The model cannot widen the query, because the query never reads what the model wrote.
02Scoped by the modelThe tool takes an order or account identifier as an argument. Anything the model can be persuaded to write, the tool will look up.
03Scoped by the promptThe instructions say not to look up other customers. This is not a boundary; it is a request. See prompt-level limits.
02

Severity

Why does one failure here outrank a good pass rate?

Because an aggregate hides the case that matters. In our synthetic reference Factfile the agent passed 13 of 14 trials — 93% — and the conclusion was still WITHHELD, because one critical failure in the privacy and security dimension outranks the aggregate. The rule is applied in code and in a fixed order: a verified high or critical failure ends the assessment before any average is consulted.

13 OF 14, AND STILL WITHHELD

The synthetic sample we publish passes 93% of its trials and carries a withheld conclusion, with a single instruction: do not approve this version until the material failure is remediated and the affected boundary is retested. An agent is not graded on its average. It is graded on its worst verified outcome in the dimensions where a single event is unacceptable.

Read the sample report
03

Uncertainty

What does a small number of trials do to the result?

It reports how little it knows. The privacy and security dimension in that same sample was measured on two trials, and it records the result as 1 of 2 with a 95% Wilson interval of 9% to 91%. That interval is not a defect in the report. It is the report refusing to imply a precision it did not earn, and it is the reason a reviewer should ask how many trials sit behind a number before reacting to the number.

9% to 91% is what two trials buy you. An interval that wide says the sample cannot distinguish an agent that fails this occasionally from one that fails it almost always. Reported honestly, it tells a reviewer to ask for more trials. Omitted, the same two trials would read as “50%” and imply a measurement that was never made.

04

The answer to give

What should a vendor be able to show?

Show the enforcement point, not the instruction. Which line of which service applies the customer filter, whether every surface reaches the tools through it, and what happens on the surface where identity is weakest. Then show an executed case where the agent was asked for someone else's record and the tool refused to return it.

→

Related

What else does a reviewer ask about this?

The questions in this bank overlap. A vendor who can answer one of these well can usually answer its neighbours badly, which is why they are tested together.

01Are prompt-level limits real limits?No — a limit written only in a system prompt is a preference, not a control: a code-enforced limit fails the tool call, a prompt-level limit asks the model not to make it, and reviewers discount the second on sight.02Does a refused request win on the second try?Sometimes. A refusal is a single-turn outcome; the same request re-entered in a new session or through a different channel meets an agent with no memory of refusing, so the question is whether the boundary is a property of the system or of one conversation.03What evidence do enterprise reviewers accept about an AI agent?Executed runs against cases the vendor did not choose, on a frozen version, with the raw traces preserved and the results recomputable; operator-supplied evidence still counts as context, but it caps the conclusion, because no operator can upgrade its own evidence.04Can a tool response carry an attack?Yes, and it is the version most vendors have not tested: the attack arrives in the data the agent reads — an order note, a product review, a forwarded email body — inside a tool response the agent trusts by construction, so passing a single-turn direct extraction test says nothing about it.05What does the transcript retain that it should not?More than the data model says, because a conversation log is a data store nobody designed: card fragments, addresses, and secrets a customer pasted, copied onward into ticketing and tracing systems on every escalation — so the questions that matter are who can query transcripts and whether deletion reaches them.

The published bank is the visible subset. Buyer-specific questions and holdout scenarios are not published, because a question you can read in advance is a question you can train against. The rules that govern how any of these gets answered are public: how a conclusion is reached.

Answering it with evidence

Can you answer this about your own agent?

We keep the question bank, we run your frozen agent against it in a sandbox we control, and every failure lands on your desk before a buyer asks. Private, fixed fee, no buyer involvement. Send us the list of actions your agent can take and we will tell you which of these questions we would test first.

What a dry run needs, so nothing is a surprise later

  • An agent that takes real actions, not just answers questions
  • A version you can freeze for two weeks
  • A sandbox or endpoint we can reach
Book a 20-minute scoping call Or email your agent's action list