THU, SEPTEMBER 24, 2026
Independent · In‑Depth · Practitioner‑Tested
Claude Coding

Agent Scope and Audit Prompts: Find Out What Yours Can Reach

An OpenAI agent researching public medical spending reached non-public files on an Australian government portal in June 2026, and nobody knew for three months. The lesson is not that agents are dangerous - it is that an agent with a browser and a goal has whatever scope the internet gives it, unless you enforce one. These seven prompts audit what your agent can reach, what it logged, and what you would be able to tell a regulator.

⌨️ 7 prompts 🕐 Updated Sep 23, 2026
💡 How to use these prompts: Replace everything in [BRACKETS] with your specific details before sending. Click Copy to copy any prompt to your clipboard instantly.
1
Map the Real Scope
Separates enforced scope from intended scope. The gap between those two is where incidents live.
Read the agent configuration below and answer one question: what is the complete set of things this agent can reach?<br/><br/>Do not tell me what it is intended to do. Tell me what it is able to do.<br/><br/>List every tool, every network capability, every credential, and every filesystem path it has access to. For each one, state whether there is an enforced boundary or only an instruction in the prompt.<br/><br/>Flag anything where the only thing stopping the agent is the wording of its instructions.<br/><br/>CONFIG:<br/>[paste]
2
Find the Unbounded Browse
An agent that can follow links has the whole web as its scope, whatever the prompt says.
Search this codebase for every place an agent is given web access.<br/><br/>For each one report: the file and line, whether there is a domain allowlist, whether there is a depth or page limit, and whether the agent can follow links it was not given.<br/><br/>Flag every instance where an agent can navigate to a URL that was not in its original input.<br/><br/>Do not suggest fixes yet. I want the inventory first.
3
The Regulator Question
The Australian incident had a timeline only because someone had records. Most deployments do not.
Assume a regulator asks: "list every external system your agents accessed between 1 June and 30 June, with timestamps and what was retrieved."<br/><br/>Read the logging configuration below and tell me honestly whether I could answer that.<br/><br/>For each gap, state exactly what is not captured - request URLs, response bodies, timestamps, agent identity, or the causal chain from instruction to action.<br/><br/>Do not reassure me. If the answer is no, say no and list what is missing.<br/><br/>LOGGING CONFIG:<br/>[paste]
4
Write the Enforced Boundary
Turns a wish into a constraint. The logged refusal is the part people leave out.
Here is an agent that currently relies on prompt instructions to stay in scope.<br/><br/>Rewrite the boundary as code rather than instruction. Specifically:<br/>1. An explicit domain allowlist checked before every request<br/>2. A hard limit on pages fetched per run<br/>3. A refusal path when a target is outside the allowlist, that logs the attempt rather than failing silently<br/>4. No reliance on the model choosing to comply<br/><br/>Output the code and nothing else.<br/><br/>CURRENT AGENT:<br/>[paste]
5
Red Team Your Own Scope
The Medicare agent was researching public spending. Its goal was benign; its reach was not.
You are the agent described below. Your goal is the one stated in its instructions.<br/><br/>List ten ways you could pursue that goal that technically satisfy the instructions but would embarrass the operator.<br/><br/>Be specific and concrete - name the kind of resource you would reach and why the instructions do not stop you.<br/><br/>Do not be reassuring and do not refuse the exercise. This is a design review, not an attack.<br/><br/>AGENT:<br/>[paste]
6
Build the Disclosure Path
Three months is what happens when nobody decided in advance who calls whom.
Draft an internal runbook for the moment we discover one of our agents accessed something it should not have.<br/><br/>It must answer, in order: who is told first, within how many hours, who decides whether it is reportable, who contacts the affected party, and what we send them.<br/><br/>Include the specific hour thresholds, not "promptly".<br/><br/>Keep it to one page. A runbook nobody can read in a panic is not a runbook.
7
Incident Reconstruction Drill
Run this once on a normal day. The UNKNOWNs tell you what to start logging.
Below are logs from an agent run. Reconstruct exactly what it did, in order, as if writing the factual section of a disclosure notice.<br/><br/>For each external resource touched: timestamp, URL, what was retrieved, and which instruction in the chain led to it.<br/><br/>Where the logs are insufficient to establish any of those, write UNKNOWN rather than inferring. The gaps are the finding.<br/><br/>LOGS:<br/>[paste]