1
Inventory and data-flow map
Every agent, tool, and data store, mapped with the boundary that matters most: what the agent treats as orders versus what is merely content it reads. Planted instructions live on the content side of that line.
Your AI agents can act while nobody watches. The gate checks what they can reach.
Inbox and ticket agents. CRM and billing automations. Scheduled jobs that send, post, or charge. Internal assistants with access to files and customer data. If an agent can act while nobody is watching, its permissions are a security question, and most stacks have never had it asked properly.
The KOLLAZ Gate asks it in a fixed order, writes every answer down, and seals the evidence. No signature, no access. No access, no work.
A fit call is a conversation about scope, not a sales pitch with a timer. If the gate does not fit your stack, we say so on the call.
The gate, step by step
2
One abuse case per capability
Each capability the agent holds gets a written abuse case: the worst plausible misuse, in plain words, before anyone argues about likelihood.
3
One attacker job story per feature
Each feature gets the story of the person trying to bend it, resolved to a mitigation, a detection, or a named accepted risk. Nothing is left as a shrug.
4
STRIDE and privacy passes
A threat pass and a privacy pass over the whole map, each finding given a disposition. One test is absolute: if an agent can reach private data, read untrusted content, and send data out, all three at once, the answer is redesign, never acceptance.
5
The safety case
One page that says, in bounded words: fit to deploy, for these users, with this data, doing this job, with the residual risk named. The gaps are drawn, not hidden.
6
Fix tickets, applied with approval
In the Hardening Sprint, each fix travels as a ticket: the exact diff shown before, your approval, a backup taken, the change applied in the agreed window, and the result verified by read-back. The rollback path is stated on the ticket.
7
The watch
Monthly drift checks against the baselines taken during the sprint, a fresh planted-injection test, and a short board report. The gate reopens automatically when you add a tool, a data store, an integration, or wider agent autonomy.
Sample, built from our own systems
Fix ticket, from our own gate run. Finding: one SSH key shared across two production servers, so one leak opens both.
Diff shown before: authorized_keys, both servers, one shared key line each.
Approved by the owner. Backup: prior authorized_keys sealed. Applied: one dedicated key per server, shared key removed from both.
Read-back: login proven with each dedicated key; the shared key refused on both servers. Rollback: restore the sealed backup.
Three tiers, inclusions and exclusions side by side
Tier 1: The Gate Audit
Includes: the full gate, read-only. Inventory and data-flow map, abuse cases, attacker job stories, STRIDE and privacy passes, the OWASP agentic checklist, and the safety case. You receive the client report with findings ranked by risk, each with a fix specification or an honest contain-only line.
Excludes: any change to your systems. The audit touches nothing; fixes are Tier 2 or your own team's work.
By engagement · Price set by scope after a fit call
Tier 2: The Hardening Sprint
Includes: everything in Tier 1, plus the agreed fixes applied as tickets with diff, approval, backup, read-back, and rollback. Fixes that cannot be fixed are contained and carried as named residual risks, never quietly dropped. The sprint closes with a re-run of the affected gate steps and a verified fix ledger.
Excludes: work outside the agreed ticket list, and offensive testing against anything but your own in-scope systems.
By engagement · Quoted per fix ledger after the audit
Tier 3: The Watch
Includes: monthly drift diffs against your baselines (access rules, DNS, payment artefacts, privileged accounts), a fresh planted-injection test against your agents, pre-fire review of new automations, and a short board report.
Excludes: fix work itself; a needed fix is quoted separately in writing before any work.
Monthly retainer · Terms set at engagement
Never included at any tier: our method library, scoring weights, injection test fixtures, or internal runbooks. No certification, compliance attestation, or legal advice; where a finding touches law, the report says so and names the gap, and your own counsel rules. We make no SOC 2 or ISO claims, and a report that pretended otherwise would not be worth buying.
The founding case: our own stack
On 2026-11-09, before this product was offered to anyone, the full gate ran on KOLLAZ's own systems: our servers, our mail, our agent tooling, our own automations. It is the only case we publish, because it is the only one that is ours to publish. Client cases appear only with written permission, and none are claimed here.
What the gate found on us
Real defects, at class level: root SSH login still enabled on production servers; one SSH key shared across servers; family and household material able to ride into delegated agent contexts that had no business holding it; standing files an agent could mistake for live instructions. The gate does not grade on a curve for its owner.
What we did about it
Every critical and high finding was fixed in the same programme: root login disabled, one dedicated key per server, material scoping rules written into standing law, and each fix verified by read-back rather than by intention. Accepted risks were named in writing, not buried.
Why we publish it
A new firm has no client wall to show you. What it can show is the method, run on itself, with the receipts. When client work exists and permission is granted, anonymised cases will join this one; the engagement flow already asks for that permission at close-out.
Sample, built from our own systems
Sealed evidence manifest, shape of. Every engagement deliverable ships with a manifest like this one, minus the client material:
artefact: gate-report.pdf · sha256: printed in the manifest · sealed at close-out
artefact: fix-ledger.csv · sha256: printed in the manifest · one line per ticket
artefact: evidence-bundle.zip · sha256: printed in the manifest · secret values never captured
The seal habit is live on this site: the home page carries this site's own sealed manifest, and your browser can read it back.