AI can write the workflow.You pay for what it cannot do.
Most AI incidents in small businesses are not science fiction — they are an agent with an over-privileged API key, a moderation check that fails open when a database times out, or a chatbot tricked into promising a refund. I audit what your AI agents are allowed to read, write, spend and send, and put hard technical gates in front of everything that matters. Starting at $500.
Trust comes from a boundary the agent cannot cross, not a polite prompt.
01 · Fail-closed vs. fail-open behavior
In a recent client mobile app review, an AI-written moderation check failed open: if the database timed out before the ban list loaded, banned users were let right back in. A second independent review caught it, and we locked it down with 72 automated tests before launch. I check every auth, billing and moderation path in your AI stack for fail-open bugs.
02 · Action boundaries (money, messages & deletes)
We inventory every tool your AI agents can call and draw a hard technical line between what an agent may draft or read on its own and what requires a human approval click: refunds, outbound customer promises, price changes and record deletions.
03 · 70-scenario adversarial & prompt-injection simulation
Before a customer-facing chat, voice or email agent goes live, we run 50 ordinary customer inquiries and 20 adversarial probes — attempts to trick the bot into inventing discounts, leaking another customer’s order, or ignoring company policy.
04 · Shadow AI & model-training data hygiene
We audit which third-party AI tools your staff paste customer records or code into, turn off model-training retention on commercial API accounts, and scan git history and client bundles for leaked API keys.
Read-only review, adversarial test suite, and a plain-English scorecard.
Pricing: $500 working review + written plan · $1,500 to $2,500 full permissions, prompt-injection & fail-closed audit.
- Step 01
15-minute fit call & Mutual NDA
Tell me what AI agents, automations or internal copilots your team is running or about to launch. Before you share architecture docs or repo access, we sign a Mutual Confidentiality Agreement via SignWell.
- Step 02
Read-only permissions & failure-mode audit
I inspect your agent prompts, tool definitions, API scopes, database row-level security and error handlers to see what happens when an external API fails or a user sends a hostile prompt.
- Step 03
Adversarial simulation & written safety scorecard
Within 48 hours you receive a severity-ranked PDF report showing every over-privileged tool, fail-open path, data-leak risk and prompt-injection failure — with the exact code or configuration fix for each.
- Step 04
Fix it with your team or hire me at a fixed price
Your team can implement the guardrails straight from the report, or hire me at a fixed price to wire the approval gates, least-privilege scopes and automated regression tests.
Who needs an AI safety and permissions review?
Any founder or operator whose team has connected AI agents to customer support, email, calendars, CRMs or databases — or who is about to launch a customer-facing AI feature and wants a senior engineer to verify it will not embarrass the company or leak data.
How much does the AI safety and permissions review cost?
It starts at $500 for a focused 60-to-90-minute working review and written safety plan, or $1,500 to $2,500 for a full multi-agent permissions and adversarial simulation audit ($500 working review + written plan · $1,500 to $2,500 full permissions, prompt-injection & fail-closed audit).
What is a fail-open bug in an AI workflow?
AI coding tools usually write the happy path: they check a rule when the API responds normally, but if a network timeout or empty response occurs, the code quietly continues instead of stopping. We test those failure modes explicitly so an outage never bypasses a safety rule.
Do you need write access to our production systems?
No. The review is strictly read-only under a signed Mutual NDA. All adversarial prompt simulations run against staging or a local emulator harness.
Have a full AI-built web or mobile application that needs a 6-pass codebase audit? See the AI app production-ready review. Need scoped connectors to your CRM or database? See MCP & tool integration.
Make sure your AI agents fail closed.
Tell me what your agents have access to on a 15-minute call. I will tell you where the real risk lives and whether a $500 safety review is worth your money.