How does Prefactor define agent risk?
Risk is broken into two halves. The action profile is what your agent is permitted to do — create, read, update, or delete data, trigger financial transactions, send external communications. The data profile is the categories of sensitive data flowing through it, classified from public through to secret. Together they tell you how much damage an agent could do, and how much of that surface area it’s actually using.
What types of data does Prefactor look for?
Seventeen categories in total, including standard PII (names, contact, location, behavioural), financial records, credentials, confidential business data, and the GDPR Article 9 special categories — health, biometric, genetic, racial or ethnic origin, religious belief, political opinion, sex life or orientation, and trade union membership.
What’s the difference between what an agent can do and what it’s actually doing?
The first is the design — the permissions and data access an engineer declared when they built the agent. The second is the reality — what the agent has actually invoked in production. Most teams only see the first. Prefactor shows you both, side by side, so you can see where an agent has drifted from what it was designed to do.
How does an engineer declare risk on an agent?
Risk is declared in the schema, not sniffed from payloads at runtime. Each span type in your agent has a data risk definition: which categories of data flow through its inputs and outputs, what classification level they’re at, and what actions it’s allowed to take. That makes the risk profile auditable, version-controlled, and reviewable by a human before it ever runs.
How is an Agent Audit different from a security audit?
A security audit asks whether your infrastructure is hardened. An Agent Audit asks something different: whether the agent itself is doing what you think it’s doing. It’s the layer between the model and the systems it touches — the part most security tooling doesn’t cover yet.
Do I need to share production data or credentials?
No. We work from your agent’s schema definition and a sample of recent runs. You don’t need to hand over production credentials or live customer data to get a meaningful read on the risk profile.