Make the API boundary consistent.
Create an owned interface inventory and a shared request-contract review. Platform defaults can make safe behavior easier, but application teams still need to supply the resource and permission context. Start with one service and document where the gateway stops and business authorization begins.
A useful first deliverable is a route review with owners, accepted inputs, downstream dependencies, and test cases for both expected and rejected requests. Keep older versions and workers visible.
Explore request boundaries ↗Turn access rules into evidence.
Review the relationship between actors, tenants, objects, and actions. A permission rule is easier to reason about when another engineer can describe it without reading the entire middleware stack. Identify the authoritative context for that rule and the event that explains its decision.
A useful first deliverable is an authorization matrix using synthetic resources, including cross-tenant cases, removed members, nested objects, and background jobs.
Build your security review ↗Connect autonomy to accountability.
Trace the user request through retrieval, model calls, tool proposals, execution, and final output. Make the model’s role distinct from the executor’s permission. Add deliberate stopping conditions and specific approvals where an action can create meaningful consequences.
A useful first deliverable is a workflow diagram showing delegated identity, tool scopes, untrusted content, resource budgets, and the exact point where a proposed action is authorized.
Review agent permissions ↗Investigate without guessing.
Choose the evidence needed to explain latency, denials, consumption, and execution outcomes. Include the health of collection itself. An empty panel may reflect missing events, so document coverage before treating the absence of alerts as evidence of normal behavior.
A useful first deliverable is a small synthetic incident exercise that another on-call engineer can reconstruct using only approved telemetry and the current runbook.
Plan your monitoring ↗