For teams building AI support agents
Your agent can issue a refund. Who checks the amount?
Before you give an agent more access, check the rules around what it can do. EverHarden reviews refund and account-change workflows for missing approvals, unreliable inputs, and ways around your controls.
One workflow to start. A report your engineers can use.
The question behind the review
Where does a suggestion become an action?
An agent reads a support ticket. It decides the customer should get a refund. Then it calls a tool that can move money.
That last step needs its own checks: the amount, the customer's eligibility, and any required approval. We look at those checks and the paths around them.
The result should be specific enough to act on: which path needs attention, why it matters, and what to fix first.
A practical place to start
Support agent
permissions review.
Bring one workflow you want to put into production, or one you're already running. We'll agree the scope before you commit.
€750one-time review
plus applicable tax
Proposed package: one agent, one workflow, up to 10 tools.
Discuss this review ↗
What you take away
- 01
A map of what the agent can change
The tools in scope, the systems they affect, and the approvals they should require.
- 02
Findings with the evidence behind them
Missing rules, questionable input sources, and possible bypasses. Each finding states what was checked and what still needs verification.
- 03
A fix list and a walkthrough
Prioritized changes for your engineer, discussed together in a 30-minute handover.
This package reviews the materials we agree to inspect. Production integration and ongoing monitoring are separate work.
What a useful finding looks like
Something your engineer can fix.
This is a made-up example showing the proposed report format. It isn't a customer result.
EXAMPLE / 01Needs verification
Approval comes from the same agent requesting the refund.
Materials reviewed
An example tool schema accepts approval_verified as an argument supplied by the agent.
Why it matters
If the receiving service trusts that flag without checking an approval record, the agent may be able to authorize its own request.
Next check
Inspect the service's authorization logic. Test whether a request with no valid approval record is rejected.
Suggested fix
Resolve approval from a trusted service, bind it to the specific refund, and validate it before execution.
A tool schema alone doesn't establish a vulnerability. The service may already enforce the missing check.
When you're ready to add enforcement
Check the action before it runs.
EverHarden Gate evaluates structured inputs against your rules at an integration point before a tool executes. A pilot can start in shadow mode, logging decisions while actions continue.
Coverage depends on the integration: actions that bypass the gate aren't protected by it. The review helps identify those gaps before you depend on enforcement.
Try the Gate demo ↗
Before we talk.
Is this right for our team?
Start here if your support agent can issue refunds or change account details and you have an engineer who can help inspect the workflow. If the agent only drafts replies for a person to approve, this review may be less urgent.
What do you need from us?
Initially, a short description of the workflow and its tools. After we agree the scope, we'll arrange a suitable way to review the relevant schemas, policies, and integration details. Don't send credentials or customer records in your first email.
Does a review certify that our agent is secure?
No. It records the checks performed, findings, and limits of the review. Other tools, permissions, or later changes can introduce risks outside that scope.
How long does it take?
We'll confirm a delivery date after reviewing the scope and the materials available. Integration work, if needed, is quoted separately.
Do we have to buy Gate afterward?
No. The review is a separate engagement. You can use the findings to improve your existing controls.