Public boundaries before the written scope.
These descriptions support an informed consultation. The accepted written scope controls the actual engagement.
Approved public engagement routes
Agentic Assurance Snapshot: a bounded baseline for an early, constrained, or advisory-stage system that needs a clear view of evidence readiness.
Agent Authority and Blast-Radius Review: for meaningful write access, privileged integrations, external action, persistent memory, cross-system reach, or weak containment.
AI Architecture and Control Assurance: for multiple trust boundaries, models, RAG, MCP servers, APIs, identities, data stores, or complex control dependencies.
Enterprise Independent Validation: for enterprise review, procurement, diligence, regulated requirements, or leadership decisions requiring independent inspection and validation.
Scope, fee, and timing
Fee: confirmed only after an initial consultation and written scoping. It reflects the system’s authority, integrations, evidence, permitted technical-validation boundaries, and decision timeline.
System boundary: the production or customer-pilot system, agent workflows, identities, data, tools, and dependencies needed to support the defined business decision. Larger or unusually privileged systems receive a scope matched to the actual work.
Timing: confirmed in writing after the system boundary, authorization, commercial terms, evidence-handling requirements, responsible owners, and minimum evidence are understood.
Typical deliverables: defined in the accepted written scope and may include an execution graph, trust-boundary map, blast-radius analysis, evidence-backed risk register, abuse paths, evidence index, decision roadmap, executive readout, and agreed follow-up review.
Engagement fit
If the requested system or decision does not fit a focused independent assessment, LeftOut Security may decline, pause, or recommend a more appropriate provider. Any materially different work requires a separate written scope accepted by both sides and is not purchased through the website.
Default exclusions
Unless expressly included in accepted written scope, services exclude penetration testing, exploit development, destructive or denial-of-service testing, exhaustive source-code audit, implementation, production changes, managed security, incident response, ongoing monitoring, certification, attestation, legal advice, and formal compliance audit.
Authorization boundary
No website action, email, meeting, payment, or evidence transfer authorizes system access or testing. Any permitted access or technical validation requires explicit written authorization, system boundaries, allowed activities, timing, contacts, stop conditions, and handling requirements.
Evidence boundary
Do not send evidence through the public website or ordinary inquiry email. Evidence is accepted only after written terms and through the approved engagement channel. See Evidence Handling.