The question is not only what an AI says. It is what it attempts, whose authority it uses, what its tools change, and whether its account matches the evidence.
Our expanded research engine includes eight synthetic workflow scenario families and four local control specimens. Offline tests exercise their measurement and refusal behavior. These are development results, not model safety results or evidence that a customer's deployment has passed.
The extension does not add coverage to earlier reports, change the published certification gates, or establish universal safety. Scope, applicable tests and evidence requirements must be agreed for each examination.
Could an agent use another service or publish an artifact without authority while gathering ordinary information?
Research scope: simulated action permission, attempted publication, control effects and accurate reporting. No public service is attacked in these tests.
Could an agent release a profile or transfer a record to a recipient outside the allowed purpose?
Research scope: fictional data and release boundaries. The present module does not measure real-person identification or general inference capability.
Does a worker receive only its actual authority? Does prepared work stop when permission is withdrawn?
Research scope: a scripted worker and delivered permission changes. Real multi-agent coordination remains further examination work.
Does a request embedded in retrieved material get treated as an instruction from the owner?
Research scope: an explicit untrusted-content boundary. Broader prompt-injection resistance requires additional sources, contexts and tested configurations.
Can an examination distinguish legitimate help from deceptive, manipulative or exploitative assistance?
Status: domain-specific development and qualified assessment. Authorization checks alone do not establish these protections.
What does an observed response or simulated outcome actually establish about dangerous capability?
Status: specialist scope and evidence requirements. The workflow extension does not establish operational capability or resistance to these harms.
| Subject | Evidence sought | Important distinction |
|---|---|---|
| Model behavior | Responses, abstention, factual support, privacy and fairness under the supplied context. | A response test does not establish application security. |
| Configured agent | Actions under the exact tools, policies, memory, permissions and delegation arrangement. | A blocked attempt remains conduct evidence. |
| Deployed system | Enforcement, data handling, integrations, isolation and recovery in an owned test environment. | A local control specimen is not a vendor deployment assessment. |
| Supplier and organization | Lineage, training permission, release controls, incident response and governance records. | Some claims require privileged evidence, not model questions. |
| Examination apparatus | Coverage, measurement validity, sampling, replay and evidence integrity. | Invalid measurement is invalid evidence, not a model failure. |
We distinguish a mapped risk, a specified examination, an implemented test, execution on a named configuration, independent validation, and adoption for a certification claim. An applicable unexamined area remains visible.
Our development registry uses Google SAIF to organize security mechanisms and controls, alongside ATBAE's human-harm and measurement dimensions. This mapping does not establish SAIF certification, Google endorsement or comprehensive protection against unknown risks.
Statistical bounds apply to defined claims under stated assumptions. An observed prohibited action, a verified file hash and an estimated population rate are different kinds of evidence. We do not assign a single trustworthiness probability to every system or organization.
Models are assessed against the information and obligations actually supplied to them. We do not fail a model for deliberately withheld intent. Legitimate completion and unnecessary refusal are assessed alongside prohibited assistance.
Read the examination method · Discuss the required examination scope