Most companies know what their agents are supposed to do. Few have watched one wander. The assessment lets you watch it in a controlled setting, before the consequences are real.
How the two weeks run
What we need from you
One agent workflow to test. Read-only access to a sandbox or test environment. The written policies that agent is supposed to follow. One point of contact for the two weeks.
Your team spends a kickoff call, a boundary review in week one, and a working session at the end. We do the rest.
What you get
- A written report with findings ranked by severity, and a recommended fix for each one.
- The full audit log from every test run.
- A boundary set tuned to your workflow.
- A working session to walk your team through all of it.
- One re-test of the same scenarios within 30 days, shown beside the first run so you can see which fixes held.
What it isn't
The assessment is not a compliance certification. It does not test your infrastructure, and it never touches production data. A passing re-test means the fixes held against the scenarios we ran. It doesn't prove an agent is safe in every case, and we won't tell you it does.
Questions people ask first
Do you need access to our production systems? No. Everything runs in a sandbox on synthetic or scrubbed data. Any access we need is approved by you and limited by time. We sign a mutual NDA before the work begins.
Who owns what comes out of it? You own the boundary set and the report, and you can share them with your auditors. VitreousAI™ keeps the framework and the tooling.
Are you SOC 2 certified? Not yet. SOC 2 Type 2 preparation is underway, and the Trust page shows where we stand. The assessment runs in a sandbox, so it never touches your production systems or real records.
Where it leads
If the findings point to a live deployment, the assessment becomes the starting point for a pilot. Your boundaries are already built, and your team has already watched containment work on your own agent.
Investment is scoped on a call.