From attack surface to business consequence.
Trace suspicious agent inputs through tools and trust boundaries. Learn which action paths are source-supported, what remains unverified, how to fix the control boundary and what evidence makes the finding defensible.
Read a real HAIEC report alongside the exercise
The Kestrel Agent Assurance sample describes 44 source-backed consequential paths at frozen source commit 5e65843. That is not 44 proven exploits. Policy, runtime grants and observed execution were not established in that public example.
Find the consequential path
Untrusted content may influence a model. A meaningful security review follows whether that influence can reach a privileged operation, and what separate evidence would establish execution or effect.
First prove the code path
A source analyzer may establish a reachable function or a bounded candidate mapping. Neither is automatically a runtime exploit.
Then qualify business authority
IAM credentials, approved policy, delegated choice and actual guard enforcement are separate facts. Their coverage can differ in scope, version, actor and time.
Six engineering threat families
Select a family to see how an untrusted input or overly broad agent capability can reach a sensitive target.
Security conclusion rule
Choose an attack-to-consequence pattern
Scenario details
Ask five distinct evidence questions
Each plane has a different producer and does not automatically imply the others. Switch planes to inspect the proof required in the selected attack case.
Agent Audit report vocabulary
Established: Source-qualified claim for exact scope. Unestablished: A meaningful question the evidence cannot answer. Not assessed: No eligible source/analysis for that dimension. Limitation: Coverage, version, identity or causal gap explicitly retained.
Make the engineering decision
What changes when a new fact appears?
This is a learning aid, not a runtime finding engine. The original code path remains a separate source fact when permission or telemetry changes.
Engineer the correction and verify it
Five core HAIEC facts
These facts are independent peers. A control configured on a route is not automatically applied at the target. A valid report digest cannot replace a missing source or effect witness.
What a HAIEC report actually establishes
Real generated sample
Read the bounded Kestrel evidence and inspect exact paths, source scope and unknown authority.
Open the Kestrel sample reportReport contract
The Agent Audit report has question, answer, status, evidence, limitations and closure prompts. The AI Security report also separates qualified security findings from raw rule matches and incomplete coverage.
AI Security overviewWhat this course does not generate
No HAIEC scan, canonical U5 evaluation, Agent Audit record, U6 receipt, authenticated target effect, compliance judgment, or production security finding. Exports are educational worksheets.
Prepare the developer finding packet
Capture a scoped, evidence-limited finding. Export your notes to an editable Markdown or JSON file. Avoid including customer secrets or private source code in this offline training artifact.