Test your agents where they run. Keep the signed result.
Coriqo has 49 checks on how your AI agents behave: whether they stay inside their limits, resist being tricked, and stop when told to. You run them inside your own systems. Coriqo signs the checks, confirms they really ran, and seals the result in the same record an examiner can check on their own computer.
A made-up example to show the shape of a result. Not a customer run.
Grouped by how an agent actually fails.
Each check reads a record of what the agent did, or evidence you supply, and applies fixed rules. The technical word is deterministic: the same evidence always gives the same answer, and no AI model grades another. If evidence is missing, the check says it can’t tell. It never reads as clean.
Misuse of tools
Using tools it wasn’t approved for, being tricked by hidden instructions (prompt injection), gaining more access than it should, or doing something other than what was approved.
Data and passwords
Data leaking out through the agent’s own output, passwords or keys shared between tasks, memory that can be rewritten, and breaches of policy.
The stop button
When you stop an agent, does it refuse new tasks, stop work in progress, lose its tools and keys, leave a record, and restart safely?
Outside tool connections
For agents that plug into tools through MCP servers: only approved servers, tool descriptions with hidden instructions, one tool posing as another, and data crossing between servers.
Agent identity
Keys that live too long, permissions that widen as work is handed on, and accounts that outlast the agent they belonged to.
Agents working together
Endless loops, permissions that grow as work passes along, data crossing boundaries, identity lost on the way, and a shutdown that doesn’t reach every agent.
Staying in bounds
Whether an agent stays inside what it was approved to do when it is offered more.
Chatbots and models
Checks for AI that looks things up (RAG), generative AI, and classic models. For models, Coriqo works out the verdict from metrics you computed. It never re-scores the model.
From scoping to a sealed package.
Many banks won’t let a vendor aim test attacks at a live agent, so the design doesn’t need one to. The checks run on your side. Coriqo prepares and signs them, confirms they ran as given, and seals what came back.
- ScopePick the agent and what to check. A second person approves, and an agent’s own developer can’t review it.
- RunA small signed program runs the checks inside your systems. The test inputs ship with it, so it needs no API key.
- ConfirmCoriqo confirms the run used the exact checks it was given. A run that can’t be confirmed can’t support a conclusion.
- ConcludeEach control gets a result worked out by rule, which nobody can override. A reviewer who isn’t the agent’s owner signs off the overall conclusion.
- SealThe package goes into the same signed log as every other record, so a reviewer can check it without a Coriqo account.
Four results. “We can’t tell” comes first.
If a run can’t be confirmed, a check can’t reach an answer, or the readiness checklist isn’t finished, the result is insufficient evidence, however good or bad the rest looks. Evidence you can’t trust shouldn’t produce a confident answer in either direction.
- Result
Assurance supported
The evidence holds up and the checks passed.
- Result
Conditional
Passed, with conditions that someone has to meet.
- Checked first
Insufficient evidence
We can’t tell. A run we couldn’t confirm, or a check that couldn’t reach an answer, lands here.
- Result
Not supported
A check failed, and the failure goes on the record as a finding.
Fix it, run it again, see the difference.
After a fix, you run the same checks on the agent’s new activity. Coriqo puts the before and after side by side, so the fix is shown and not just claimed. That comparison is what you hand an examiner or a customer’s risk team.
- Exactly the same checks as the first run, locked in
- Before and after in one view
- The retest is sealed in the record like the first run
Evidence goes stale. Coriqo says when.
Coriqo schedules the re-runs and tells your pipeline when one is due. When a re-run is overdue, the result is marked out of date and doesn’t sit there looking current. A check from last quarter doesn’t vouch for this week’s agent.
- Scheduled runs for each agent, started by your pipeline
- Overdue results flagged as out of date
- Every run lands in the same sealed record
AI proposes attack inputs. Code decides the outcome.
An AI model writes the test attacks once, when the checks are put together, and they are locked into the signed package. The model can add things to test. It can’t remove one, and it can’t change a result. Every pass and fail comes from fixed rules.
What this doesn’t claim
We don’t test your live agent ourselves. The claim is that these checks, with these inputs, ran against this version of your system, and here is the signed record. It is narrower than “we tested your agent”, and it is the version a bank’s security team can accept.
Scope one agent.
A scoping call covers which agent, which checks, and what your bank or customer will ask for. Our services team can run the assessment with you if you want the help.