1. Describe your agent

   What does the agent do, who does it serve, what must it never do?

   • Knowledge-retrieval agent for the internal HR knowledge base.
   • Task agent that drafts customer-support replies for human approval.
   • Autonomous agent that triages incoming security alerts.

2. Describe the platform

   AgentProof works the same for any platform — name it briefly.

   • Custom LangChain stack hosted in AWS.
   • Open-source LLM behind an internal API gateway.
   • Vendor agent SDK deployed in our private cloud.

3. Capability zone

   AgentProof classifies the agent into Zone 1, 2, or 3 — read the zone explainer next.

   • Zone 1 — Knowledge / Retrieval Agent.
   • Zone 2 — Task / Tool-Assisted Agent.
   • Zone 3 — Autonomous Action Agent.

4. List the documented evidence

   What documents exist already? Intended-use statement, owner, tool permission register, audit log, monitoring cadence.

   • One-paragraph intended-use statement (versioned).
   • Named business owner + backup.
   • Tool permission register reviewed quarterly.

5. Start the assessment

   AgentProof runs the same source-bound assessment as for Microsoft.

   • Capability + risk modifier questions tailored to the zone.
   • Evidence-confidence questions tailored to the source list.
   • Multi-select questions for tool registers and oversight rules.

6. Generate the report

   Same report shape as Microsoft — capability zone, controls, evidence, references, compatibility panel.

   • Score band + verdict.
   • Source-bound recommended controls.
   • Compatibility note for future intelligence-pack changes.

7. Improvement cycle

   Pick priorities, define target outcome, mark ready for reassessment.

   • Strengthen evidence on the named risks.
   • Document the autonomy boundary.
   • Add an escalation route.

Source label: User-declared manual. AgentProof never makes a legal compliance / certification / audit claim.