Check an agent before you use it¶

Use this checklist before you add an agent from another person or team.

1. Identify it¶

Confirm the owner, agent name, fixed version, package identity, and source. Do not accept “latest” as a version.

Identify the computer or hosted service that will process the work. Ask who can see plaintext and whether the runtime has independent verification.

The provider receives prompts and allowed files in plaintext. Confirm the provider, account, retention terms, and permission to send the data.

List the files, tools, network routes, and output targets that the agent needs. Reject broad access that the stated task does not need.

Try a file and tool that are outside the allowed set. GaugeDesk must deny the action. Missing or invalid permission must never grant access.

Confirm that projects stay on a fixed version, how you approve an update, how future use can be stopped, and what past records remain.

Save the agent identity, version, package, provider, limits, test results, approvals, and date.

Accept the agent only if you can answer all seven sections and the tested behavior matches the stated behavior.

For deeper checks, see Verify security claims.