# AI agent hardening and control

[Original page](https://danilolapegna.com/en/services/hardening-controllo-agente-ai)

Language: en.

Reduce unwanted actions and excessive permissions in an AI agent, and test what happens when something goes wrong.

## A good fit when

Teams with a concrete agent, an accessible repository and defined operational responsibilities.

## The problem

The agent works in ordinary tests, but malicious inputs, permissions, failures and recovery have not been checked adequately.

## What you are buying

The findings, with any vulnerabilities ranked by risk, and the agreed fixes to address them.

## Price and timing

- From €12,500 excl. VAT
- Assessment and agreed fixes
- 3–5 weeks
- Remote · one application or agent

## Included

- Threat and action mapping
- Permission and tool review
- Adversarial tests
- Agreed plan/fixes

## What we test: the classes that apply to your agent, within the agreed scope

- Hidden instructions in emails, documents or pages the agent reads (direct and indirect prompt injection)
- Permissions and tools beyond what the task needs: unauthorised actions, access to other customers’ data or accounts
- Misuse of connected tools, including through MCP (the protocol that connects the agent to tools), and chains of actions that bypass controls
- Confidential data leaking into answers, logs or external systems
- High-impact actions, such as payments, refunds or data changes, without human confirmation
- Reconstructing failures: logs, traceability and recovery
- [Reference risk classes: OWASP Top 10 for agentic applications](https://danilolapegna.com/guides/owasp-top-10-agentic-applications-italian-smb.html)

## Required inputs

- Repository and architecture
- Tools and credentials used
- Available logs or incidents
- Technical owner

## Process

- Review actions, access and permissions
- Test attempts to bypass controls
- Separate real risks from false alarms
- Verify fixes

## Planned verification

- Reproducible findings
- Controls linked to risk
- Regression tests for fixes

## Who does the work

- Fifteen years building software people rely on.
- 15+: years in software engineering
- Seed → IPO: product leadership through a public listing
- 3.2★ → 4.7★: App Store rating during the team's work at bunq
- SDA Bocconi: two sessions on applied and agentic AI
- These results describe my experience. For your project, we define goals and measures around your company’s process.

## Scope limits

- One codebase or application
- Up to 3 tool/RAG boundaries
- Repository and test-environment access
- Not a certification or full infrastructure penetration test

## Exclusions

- Formal certification
- Full legal compliance review
- Security checks without a concrete attack scenario

## Essential terms

- 50% at start · 30% on delivery of findings · 20% on retesting
- Commercial tools, environments and travel excluded
- One retest of agreed fixes within 30 days
- Initial technical assessment within 2 business days

## Acceptance criteria

- Reproducible prioritised findings
- Fixes linked to risk
- Regression tests and declared residual risk

## Related evidence and reading

- [Agentic AI security for SMEs: what to check before production](https://danilolapegna.com/guides/agentic-ai-security.html)

The verification steps are engagement criteria, not outcomes already achieved for every client.

## Next step

- [AI agent hardening and control](https://danilolapegna.com/en/services/hardening-controllo-agente-ai)
- [All services compared, with the request link](https://danilolapegna.com/en/agents)
- Email: hello@danilolapegna.com
- [Terms](https://danilolapegna.com/terms)

B2B service. An enquiry creates no commitment: price and scope become binding only in an accepted written proposal. This document does not confirm availability or appointments.