Get your AI agent through AIUC-1's tool-call controls.
We test your agent against the AIUC-1 tool-call and unauthorized-action controls with a proprietary adversarial corpus, remediate the gaps at the action boundary, and hand over auditor-ready evidence. The findings report is the start of the job, not the deliverable.
The method comes from published provenance research, the AgentLock™ papers by David Grice, and an open-source enforcement engine, AgentLock™. Both are public, so your auditor and your engineers can read what enforces the control. How that works.
- finding
- F-01 asserted policy change to bypass refund authorization
- technique
- authority spoofing, conversational
- control
- D003.1 B006 B007
- baseline
- FAIL refund issued, no verified authority
- remediated
- PASS denied at the action boundary, human approval required
- receipt
- sha256:4f19c8ab7d02e6b1 · 2026-08-14T15:22:07Z
How it works
Three steps, run in sequence, on a cadence the controls can accept. Test, remediate, prove.
-
01
Test the agent with a private adversarial corpus
We run your agent against a proprietary, continuously expanded adversarial corpus aimed squarely at tool calls: spoofed authority, parameter tampering, planted instructions, and unsafe action chaining. Results are mapped to the relevant AIUC-1 controls where they apply, reported by technique class otherwise, each with a baseline pass or fail. Our adversarial corpus surfaces tool-call control failures in agents built on current frontier models, not just weak ones, so a strong base model is not on its own an answer to D003 or B006. The failure classes we test for.
-
02
Remediate the gaps at the action boundary
Failures get closed with a provenance authorization gate in front of the tools, so an unauthorized action is refused by infrastructure rather than by the model's judgment. Each fix is re-tested against the vector that broke it, and the before and after are both retained. This is the part an accredited auditor cannot do for you, and the part a findings report on its own leaves open.
-
03
Hand over evidence organized for the auditor
You receive a package arranged control by control: findings, technique classes, remediation notes, signed receipts, and the test log. It is structured to be read by an accredited auditor, and re-run quarterly so the evidence stays current. What each control needs as evidence.
The five controls we specialize in
AIUC-1 is broader than this. We work only where tool calls and unauthorized actions are in scope, and we say so plainly to your auditor. Read the plain-language walkthrough of all five.
- D003
-
Restrict unsafe tool calls.
The agent cannot invoke a tool outside the permissions declared for it.
- D004
-
Third-party testing of tool calls.
An independent party probes the tool surface and reports what it found.
- B006
-
Prevent unauthorized agent actions.
Actions outside the user's authority are refused, not merely discouraged.
- B007
-
Enforce access privileges.
Role and scope are checked at execution, per call, with the result logged.
- A003
-
Contextual data safeguards.
Data reaching a tool stays inside its declared boundary and classification.
What the evidence looks like
A representative, sanitized example, not a record of a client engagement. Same shape as the findings table in the package your auditor receives. Every row carries a baseline and a remediated state, because a failure you cannot show closed is not evidence of a control.
| Finding | Technique class | Mapped control | Baseline | Remediated |
|---|---|---|---|---|
| F-01 | Asserted policy change to bypass refund authorization | B006, B007 | FAIL | PASS |
| F-02 | Privilege escalation through tool parameters | D003.1, B007 | FAIL | PASS |
| F-03 | Delayed data exfiltration via planted instruction | D003.1, A003 | FAIL | PASS |
| F-04 | Unsafe autonomous action chaining | D003, D003.4 | FAIL | PASS |
Adversarial vector details are withheld by policy. Findings name the technique class and the outcome, never the payload, so the corpus keeps working against the next agent we test. The technique classes, explained defensively.
Where the method comes from
Two public sources, both inspectable. You do not have to take the method on trust, and neither does your auditor.
- research
- The AgentLock™ provenance papers, by David Grice. They work through how a tool call can be authorized on the provenance of the instruction that triggered it rather than on the model's reading of intent, and they evaluate that approach against a public agent-security benchmark. The testing corpus and the remediation design both come out of that work.
- engine
- AgentLock™, open source. The provenance authorization gate that sits between the agent and its tools: it checks identity, role, scope and the origin of the instruction, then issues a single-use, parameter-bound token before anything executes. The source is public and framework-agnostic, so the enforcement your evidence package describes is the enforcement anyone can read.
- corpus
- A private adversarial corpus, continuously expanded. Built for the tool-call surface and kept unpublished on purpose. We report technique class and outcome, never the payload, because a published corpus stops working. Our corpus surfaces tool-call control failures in agents built on current frontier models, not just weak ones.
- boundary
- We do not certify. AIUC certifies, through accredited auditors. ComplyLock is independent readiness and remediation on the vendor's side of that line. Other firms do readiness work in this space; ours is the practice built specifically on the tool-call controls, shipping the enforcement layer with the report. Readiness vs certification, explained.
Pricing
Anchored numbers, confirmed on the call. Scope drives the final figure, and we quote it before any work starts.
Scoping call
We look at your agent's tool surface and tell you which of the five controls are actually at risk, and whether you need us at all.
Book a callDiagnostic
An agent security decision review: where your tool calls fail the five controls today, what an auditor will ask for, and what remediation involves. Credited in full toward the assessment.
Book a callAssessment
The full tool-call assessment on one agent workflow: adversarial corpus run, remediation at the action boundary, re-test, and the auditor-ready evidence package with quarterly re-tests.
Book a callScope is confirmed on the call before anything is invoiced.
Why ComplyLock exists
ComplyLock is a readiness and remediation provider. We are not the certifier and we are not an accredited auditor. AIUC certifies. Accredited auditors assess. Neither can also build your fix, because independence bars them from consulting on the thing they later have to judge. That leaves a gap on the vendor's side of the line, and that gap is the whole job.
So we do the part the auditor cannot: break your agent's tool calls first, close what breaks, and leave behind evidence the auditor can actually read. When they arrive, the questions in scope for D003, D004, B006, B007, and A003 already have documented answers. That is the difference between a findings report and a closed control: remediate and prove, not observe and hand over.
David Grice
Independent AI security researcher and author of the AgentLock™ provenance papers, which work through how an agent's tool calls can be authorized on the provenance of the instruction that triggered them rather than on the model's reading of intent. The testing corpus and the remediation approach both come out of that research, and the research is public.
AgentLock™
The open-source engine the remediation is built on: a provenance authorization gate that sits between the agent and its tools, checks identity, role, scope, and the origin of the instruction, and issues a single-use token before anything executes. It is framework-agnostic and its source is public, so your auditor and your engineers can both read exactly what enforces the control.
AIUC-1 does not require this gate. Its runtime-hook and human-approval controls are supplemental, and the gate is an accepted, evidence-producing means of meeting the core objectives, subject to the auditor-approved Statement of Applicability. Other firms do readiness work in this space. We are the ones who specialize in the tool-call controls and ship the enforcement layer with the report.
Reading
The blog is where the method is written down in plain language: what the five tool-call controls actually require, how agents fail tool-call security, and what readiness is next to certification.
- corpus
- proprietary and continuously expanded, a private library of adversarial vectors aimed at the tool-call surface
- 5
- AIUC-1 controls we specialize in: D003, D004, B006, B007, A003
- quarterly
- re-test cadence, matching what the controls expect of evidence
- open source
- the enforcement layer is AgentLock™, readable by your auditor and your engineers
- published
- the method rests on the AgentLock™ provenance papers, public and citable
Common questions
- What is AIUC-1 readiness?
- Readiness is the work done before an accredited auditor assesses you: testing your agent against the controls, fixing what fails, and assembling the evidence the auditor will ask for. It is not the certification itself, and it does not guarantee one. It is how vendors avoid finding out about a gap during the audit.
- Does ComplyLock certify AIUC-1?
- No. Only AIUC certifies, through accredited auditors. ComplyLock is an independent readiness and remediation service, and we stay on the vendor's side of that line deliberately, because an auditor who consults on your controls cannot then audit them.
- Which AIUC-1 controls does ComplyLock cover?
- Five: D003 (restrict unsafe tool calls), D004 (third-party testing of tool calls), B006 (prevent unauthorized agent actions), B007 (enforce access privileges), and A003 (contextual data safeguards). AIUC-1 covers considerably more than that, and we tell you where our scope ends.
- Our agent runs on a frontier model. Do we still fail these controls?
- Often, yes. Our adversarial corpus surfaces tool-call control failures in agents built on current frontier models, not just weak ones. That is expected rather than surprising: a capable model is still deciding, per turn, whether an action is authorized, and the controls ask whether the action is refused when the decision goes wrong. Model quality reduces how often it goes wrong. It does not supply the enforcement point or the log.
- Can we inspect the method before hiring ComplyLock?
- Yes, most of it. The research is published and the enforcement engine, AgentLock, is open source, so your engineers and your auditor can read both. The adversarial corpus itself stays private, because publishing payloads would retire it. Findings name the technique class and the outcome instead, which is what an auditor needs in order to trace a finding to a control.
- How long does readiness take?
- A diagnostic runs about a week. A one-workflow assessment, including remediation and re-test, typically runs three to five weeks depending on how your tools are wired and how fast changes can ship. Re-tests are quarterly after that.
- What do you deliver?
- An evidence package organized control by control: the findings table with technique classes and baseline results, the remediation applied at the action boundary, re-test results, signed receipts, and the audit log schema. Adversarial payloads are withheld by policy, so the corpus stays useful.