01 / Identify the acting authority
Document how the initiating user’s identity reaches every tool. Identify shared service credentials, impersonation paths and elevated roles. Ask whether a low-privilege user can cause the agent to use broader authority.
02 / Test customer isolation
Define the expected tenant for each read and action. Use synthetic records from at least two tenants and check direct queries, retrieved context, tool arguments and cached results. Confirm where the application enforces the boundary.
03 / Separate reads from writes
List available tools and their effects. Mark which actions modify data, send messages, transfer value or trigger downstream workflows. Confirm that role checks and required approvals are enforced before execution.
04 / Inspect untrusted input paths
Identify external content the agent consumes, including documents, support messages and tool responses. Examine whether that content can redirect tool use or alter the scope of data access. Treat retrieved instructions as untrusted input.
05 / Define the evidence
Record the initiating user, tenant, expected permission, relevant tool calls and observed outcomes. Make the scenario reproducible with approved test data. Log only what is needed and avoid placing secrets in traces.
06 / Plan for changes
Identify which changes require reevaluation: models, instructions, tools, credentials, retrieval and authorization logic. Retest known boundary failures after fixes. Record the evaluation scope and remaining gaps for the release decision.
Further reading
Our perspective builds on the broader work of the agent-security community. These resources offer context for evaluating agent behavior and tool access.
This is an educational perspective, not a claim of product capability or a substitute for evaluating your own system. Fuzz is building in stealth.