Object binding
Does the action still target the exact customer, order, booking, account or resource it was authorized for?
Fixed bounded entry
One consequential action. One question worth $1,500.
The Entry Audit is the smallest paid BitEvo engagement. We test one action chain and one primary control or failure hypothesis in staging/test by default, preserve the evidence, and return a bounded owner decision.
Good audit objects
Start where AI changes real state.
Examples include refunds, order changes, reservations, CRM writes, account updates, external messages, deployment changes and other actions whose result matters outside the agent itself.
What we challenge
The control question stays narrow.
Approval binding
Does confirmation remain tied to the exact material action parameters rather than a generic approval state?
External effect
Did the intended downstream change actually happen, and can the resulting state be read back?
Retry / replay
Can timeout, retry or replay duplicate a consequential effect or continue under stale state?
Identity / scope
Is the acting identity and credential narrower than the total capability exposed by the tool?
Delivery
You are buying a decision instrument, not a generic audit report.
- One bounded action / control map
- Expected-vs-observed test matrix
- Reproducible evidence within the agreed scope
- Finding, rejection or explicitly blocked test
- Limitations and residual uncertainty
- Repair / retest criterion where relevant
- One concise owner decision memo
A useful result may be PASS, FAIL, PARTIAL, REJECTED HYPOTHESIS or BLOCKED. Success is not defined as finding a vulnerability.
Commercial boundary
$1,500 fixed. One action chain. One primary hypothesis.
Not included: full penetration testing, certification, legal/compliance opinion, unrestricted production exploitation, system-wide safety claims or open-ended implementation. Broader remediation is separately scoped only when the evidence justifies it.
Prepare the bounded scope