Read the agent configuration below and answer one question: what is the complete set of things this agent can reach?<br/><br/>Do not tell me what it is intended to do. Tell me what it is able to do.<br/><br/>List every tool, every network capability, every credential, and every filesystem path it has access to. For each one, state whether there is an enforced boundary or only an instruction in the prompt.<br/><br/>Flag anything where the only thing stopping the agent is the wording of its instructions.<br/><br/>CONFIG:<br/>[paste]
Search this codebase for every place an agent is given web access.<br/><br/>For each one report: the file and line, whether there is a domain allowlist, whether there is a depth or page limit, and whether the agent can follow links it was not given.<br/><br/>Flag every instance where an agent can navigate to a URL that was not in its original input.<br/><br/>Do not suggest fixes yet. I want the inventory first.
Assume a regulator asks: "list every external system your agents accessed between 1 June and 30 June, with timestamps and what was retrieved."<br/><br/>Read the logging configuration below and tell me honestly whether I could answer that.<br/><br/>For each gap, state exactly what is not captured - request URLs, response bodies, timestamps, agent identity, or the causal chain from instruction to action.<br/><br/>Do not reassure me. If the answer is no, say no and list what is missing.<br/><br/>LOGGING CONFIG:<br/>[paste]
Here is an agent that currently relies on prompt instructions to stay in scope.<br/><br/>Rewrite the boundary as code rather than instruction. Specifically:<br/>1. An explicit domain allowlist checked before every request<br/>2. A hard limit on pages fetched per run<br/>3. A refusal path when a target is outside the allowlist, that logs the attempt rather than failing silently<br/>4. No reliance on the model choosing to comply<br/><br/>Output the code and nothing else.<br/><br/>CURRENT AGENT:<br/>[paste]
You are the agent described below. Your goal is the one stated in its instructions.<br/><br/>List ten ways you could pursue that goal that technically satisfy the instructions but would embarrass the operator.<br/><br/>Be specific and concrete - name the kind of resource you would reach and why the instructions do not stop you.<br/><br/>Do not be reassuring and do not refuse the exercise. This is a design review, not an attack.<br/><br/>AGENT:<br/>[paste]
Draft an internal runbook for the moment we discover one of our agents accessed something it should not have.<br/><br/>It must answer, in order: who is told first, within how many hours, who decides whether it is reportable, who contacts the affected party, and what we send them.<br/><br/>Include the specific hour thresholds, not "promptly".<br/><br/>Keep it to one page. A runbook nobody can read in a panic is not a runbook.
Below are logs from an agent run. Reconstruct exactly what it did, in order, as if writing the factual section of a disclosure notice.<br/><br/>For each external resource touched: timestamp, URL, what was retrieved, and which instruction in the chain led to it.<br/><br/>Where the logs are insufficient to establish any of those, write UNKNOWN rather than inferring. The gaps are the finding.<br/><br/>LOGS:<br/>[paste]