What is inside
A documented view of which agents you run, what each one is allowed to touch, who can stop it, and what you will do in the next 30 days.
- Editable AI-use inventory
- Permissions review
- Vendor questions
- Escalation worksheet
- 30-day action planner
- Executive briefing template
- One worked example, labeled as hypothetical
File formats: confirmed when the kit is built. The kit is not built yet, so there are no sample pages to show. No file is offered here that does not exist.
Who it is for. Security leads and SME technology owners who have to approve, scope or supervise AI agents.
License. Single-organization internal-use license.
Delivery. Self-service checkout and immediate download through a hosted commerce provider. None is connected yet, so there is no buy button.
Start with the free checklist
Eight questions about the agents you run and the doors you left open. One page, free, no sign-up. It is the short version of the thinking the kit turns into working documents.
Educational self-assessment. It is not a security scan, an audit or a certification. Each question restates one of Maria How's recommendations on AI agent scope. They are recommendations, not legal obligations.
Eight questions about the agents you run and the doors you left open.
Eight cards, eight doors you might have left open. In Wonderland, the Queen of Hearts' gardeners painted white roses red to hide a mistake. It did not end well for the gardeners. Answer honestly.
"Off with their heads!"
The Queen of Hearts, in Lewis Carroll's Alice's Adventures in Wonderland (1865)
Educational self-assessment. It is not a security scan, an audit or a certification. Your answers stay in this browser. Based on Maria How's recommendations in Nobody Meant to Breach WorkOS. The Agent Did It Anyway..
- Card 1 of 8
Is each agent's scope enforced outside the agent?
Find where scope is enforced. If the allowed targets, tools and data live only in a prompt or a config file the agent itself reads, that is a suggestion. Put the limit in the network, the identity provider or the tool gateway.
- Card 2 of 8
Is outbound traffic default-deny for anything that can act on its own?
Default-deny outbound traffic for anything that can act on its own, enforced somewhere the agent cannot change.
- Card 3 of 8
Is there a named human who can stop a run, and has the stop been tested?
Name the human who can stop a run, and test that the stop works.
- Card 4 of 8
Do you log what each agent was asked to do beside what it did?
Log what the agent was asked to do beside what it did, so a divergence shows up in minutes.
- Card 5 of 8
Do you have a current list of internal tools reachable from the internet?
Pull the list of internal tools reachable from outside. Yes, that list.
- Card 6 of 8
Have you hunted for development credentials in production?
Hunt for development credentials in production and block weak or development-only secrets from being deployed.
- Card 7 of 8
Are bulk reads rate-limited, with an alert on volume?
Rate-limit bulk reads and alert on volume.
- Card 8 of 8
Could you validate a researcher's claim that their agent had been in your systems?
Decide what you would do if a researcher called to say their agent had been in your systems, and check your logs could confirm or refute it.
Close the open doors faster
The AI Agent Security Decision Kit turns these moves into an agent inventory, a permissions review and a 30-day plan you can actually run.
Bring the Queen to your team: ask about a private briefing
Prefer the long game? Read the book, Red Queen Cipher (opens Amazon in a new tab)
What it is not
The kit is not a penetration test, a compliance certification, legal advice or an ongoing monitoring service. It gives you editable structure, a worked example and decision support. The deciding is still yours.
Private Team Briefing
A leadership or security team with one decision to make.
- 60-minute session on one agreed topic
- A short deck tailored to your team
- A one-page decision and action summary
Participant and preparation limits are set before booking opens.
Tell Maria the decision your team is facing and roughly who would attend. She will come back with scope, timing and a quote.
Or write to hello at redqueencipher dot com