Find the authority your agents actually have.

Compare declared tool permissions against observed capabilities, API scopes, and side effects so AI agents cannot quietly write, delete, send, execute, or administer more than intended. SecEng Agent Authority Diff turns vague agent access into a defensible permission review and hardening backlog.

Compare Agent Authority View Permission Findings

WHAT CAN YOUR AGENTS ACTUALLY DO?

Compare

Compare declared permissions, tool definitions, observed capabilities, side effects, scopes, and confirmation requirements.

Detect

Flag write, delete, send, execute, admin, secret, filesystem, browser, and network access.

Harden

Split tools, reduce scopes, add approval gates, and create audit trails.

Review

Accelerate manual permission review without replacing human security judgment.

Core capabilities

What SecEng Agent Authority Diff does.

Declared vs Observed Permissions

Compare tool descriptions and declared scopes against capabilities visible in schemas, API grants, and implementation evidence.

Excessive Agency Detection

Detect read-only claims that hide write/delete access, harmless assistants that can send messages, and support agents with delete or admin paths.

OAuth and API Scope Review

Identify excessive OAuth/API scopes, hidden admin grants, and broad permissions that should be reduced before release.

Approval Gate Analysis

Flag missing or weak human approval requirements for irreversible, external, administrative, or high-blast-radius operations.

Tool Hardening Plan

Recommend split tools, smaller scopes, confirmation gates, audit trails, and release-blocking fixes.

Threat Canvas Handoff

Feed permission findings into Threat Canvas, Release Gate, and engineering backlog workflows.

Evidence & signals

What you get out of the box.

Capability Classes

Read
Write
Delete
Send
Execute
Admin
Secret
Filesystem
Browser
Network

Findings

Permission drift report
Excessive agency findings
Scope review
Missing approval gates
Release blocking risks

Hardening Outputs

Tool split recommendations
Reduced scopes
Approval requirements
Audit trail gaps
Engineering backlog

AI SECURITY ENGINEERING WORKBENCH

Ready to put SecEng Agent Authority Diff to work?

Agent Permission Diff is an active-development SecEng Workbench capability available through scoped public-site review conversations. We compare declared and observed permissions, then produce a hardening backlog for agent tools and approvals.

Start AI Security Assessment See the full Workbench

View pricing →

Also in the Workbench

WHAT AI DO WE HAVE?

SecEng Surface Scanner

Browser, Repo & IDE AI Discovery