AI ASSURANCE GATE / AAG
Security regression testing for AI systems.
AAG runs versioned security scenarios against LLM, RAG and tool-enabled assistants, applies deterministic control logic and produces a reproducible release decision with inspectable evidence.
Test the failure modes that matter.
AAG exercises model, retrieval, policy and tool boundaries using structured, versioned scenarios.
| CLASS | FAILURE MODE | CONTROL SURFACE | OBSERVATION |
|---|---|---|---|
| 01MODEL / INSTRUCTION | DIRECT PROMPT INJECTION | USER INPUT / SYSTEM INSTRUCTION | OVERRIDE AND ROLE-CONFLICT BEHAVIOUR |
| 02MODEL / INSTRUCTION | POLICY BYPASS | MODEL / POLICY BOUNDARY | DETERMINISTIC POLICY OUTCOME |
| 03RETRIEVAL | INDIRECT PROMPT INJECTION | RETRIEVED / TOOL-RETURNED CONTENT | INSTRUCTION-BEARING CONTENT |
| 04RETRIEVAL | RETRIEVAL POISONING | CORPUS / RANKING PIPELINE | ADVERSARIAL DOCUMENT INFLUENCE |
| 05RETRIEVAL | CITATION LAUNDERING | GROUNDING / CITATION CHAIN | SOURCE ATTRIBUTION INTEGRITY |
| 06DATA | SENSITIVE DATA LEAKAGE | RESPONSE / TRACE EGRESS | RESTRICTED CONTENT EXPOSURE |
| 07TOOLS | UNSAFE TOOL CALLS | TOOL POLICY / ARGUMENTS | ATTEMPTED OUT-OF-POLICY ACTION |
| 08ASSURANCE | EVIDENCE GAPS | RUN / RELEASE RECORD | MISSING TRACE OR PROVENANCE |
Follow a decision through the system.
Move from run readiness to scenario evidence, traceability and release artefacts inside one product workspace.
DRAG TO INSPECT ↔ ↕Connect to the system you already run.
AAG evaluates an existing LLM, RAG or tool-enabled assistant through an explicit system-under-test adapter. The target system remains the system of record.
The model and retrieval path remain part of the customer system under test.
Version the threats, not just the model.
AAG executes structured scenario packs so the same assurance expectations can be re-run when the model, prompt, corpus, policy or tool surface changes.
- VERSION
- 3.2
- TARGET
- RAG + TOOLS
- SCENARIOS
- 40 / ILLUSTRATIVE
- CHANGE BASIS
- MODEL / PROMPT / CORPUS / POLICY / TOOLS
Decisions come from explicit control logic.
AAG separates test execution from gate policy. Scenario evidence is evaluated through deterministic detectors and explicit policy rules before a release state is produced.
Trace every decision to its evidence.
The Assurance Graph connects scenarios, observations, detectors, policy decisions and gate outcomes so reviewers can see exactly why a release state was produced.
DRAG TO INSPECT ↔ ↕The decision survives the runtime.
AAG produces an evidence bundle that can be reviewed after execution without requiring continued access to the live assistant.
Run identity, target and reproducibility metadata.
Establishes which execution and configuration the bundle describes.
Root index for the release record.
{
"run_id": "AAG-RUN-0247",
"created_at": "2026-08-14T09:42:17Z",
"pack": "rag-tool-safety-v3.2",
"target": "reference-assistant-hardened",
"configuration_hash": "sha256:7f4a0b8d…9c21",
"decision": "GO",
"evidence_version": "1.2"
}Run assurance where the system lives.
AAG is designed to evaluate AI systems inside the environments where they are built, changed and operated — without making a hosted SaaS control plane the centre of the assurance process.
LOCAL / AAG runs alongside the target assistant or system and retains the resulting evidence within the customer-controlled environment.
- MODE
- LOCAL
- CONTROL
- CUSTOMER CONTROLLED
- EXECUTION
- LOCAL
- EVIDENCE
- LOCAL / RETAINED
- EXTERNAL DEPENDENCY
- ENVIRONMENT-DEPENDENT
Prove one AI workflow.
A focused AAG pilot evaluates one LLM, RAG or tool-enabled assistant against an agreed threat model and produces a defensible release decision with inspectable evidence.
- 01BASELINE SECURITY RUN
- 02HARDENED COMPARISON
- 03SCENARIO-LEVEL FINDINGS
- 04GO / CONDITIONAL / NO-GO DECISION
- 05RETAINED EVIDENCE BUNDLE
- 06REMEDIATION PRIORITIES
- PILOT
- ONE AI WORKFLOW
- DEPLOYMENT
- CUSTOMER ENVIRONMENT
- OUTPUT
- INSPECTABLE EVIDENCE
- SCOPE
- AGREED THREAT MODEL