Selected Engineering Work
x402Shield
Verified selected engineering work for Rust-based AI-agent, MCP-tool, and API-payment security.
View caseLLM & AI Agent Security Review
From NZ$13,500~US$7,570Reference date: 9 Oct 2026 · Local price is authoritative; this is not a payment or settlement rate.
Buyer outcome
A targeted security review of your LLM deployment or AI agent — covering prompt injection risk, retrieval exposure, tool access boundaries, and permission gaps — with written findings and practical controls for New Zealand engineering and product teams. Written scope confirmed before any proposal, deposit, or payment link.
Why LLM and AI agent security review matters for New Zealand product teams
LLMs and AI agents deployed in New Zealand products and internal tools face security risks that differ from traditional application security: prompt injection via connected inputs, retrieval exposure when knowledge boundaries are not defined, tool access that exceeds what the use case requires, and data flows that cross trust boundaries without documented approval. These risks are not addressed by general application security reviews.
This review covers the specific risk surface of LLM and AI agent deployments: prompt injection from user inputs and connected data sources, retrieval of content beyond intended knowledge boundaries, tool and API access that exceeds permission design, human approval points absent before customer-facing outputs, and model-connected workflows that operate without a documented trust boundary review.
BilgeQor's LLM and AI agent security review is a written, scope-confirmed engagement — not a compliance certification, not a penetration test, and not a regulatory assessment. It is a practical security review for engineering teams that want documented findings and recommended controls before widening an AI deployment.
Scope drivers
Number of LLMs or AI agents in review scope
Integration depth — tools accessed, data sources, API connections
Deployment context — internal, customer-facing, or embedded in a product
Data sensitivity — customer data, internal knowledge, operational systems
Permission boundary complexity
Required findings depth and remediation guidance
Ideal for
- New Zealand engineering and product teams with a deployed LLM or AI agent ready for security review
- SaaS and digital product teams preparing a customer-facing AI feature for launch
- Operations teams that have built internal AI workflows and need written security findings
- Businesses that need a security review of an AI deployment before widening access or rollout
- Teams that want documented prompt injection, retrieval, and permission boundary findings before a review or handoff
What is included
- Prompt injection risk assessment
- Retrieval exposure and knowledge boundary review
- Tool access and permission boundary gap analysis
- Data flow and trust boundary mapping
- Human approval point gap identification
- Written findings register with risk classification
- Recommended controls and remediation guidance
- Review call
What is not included
- Legal advice or NZ Privacy Act 2020 compliance certification
- Regulatory certification or government security endorsement
- Full penetration testing beyond AI agent scope
- Guaranteed remediation or ongoing monitoring
- SOC operations or MDR coverage
- Hands-on remediation implementation
- Payment or checkout before scope is confirmed in writing
Delivery process
1
Scope intake
Confirm which LLMs and AI agents are in scope, what tools and data sources they access, and the deployment context in writing before any review work begins.
2
Security review
Structured assessment of prompt injection surfaces, retrieval exposure, tool access permissions, data flows, trust boundary design, and human approval point presence.
3
Findings classification
Findings are classified by risk level — prompt injection, retrieval exposure, permission boundary gaps, tool misuse risk, and missing approval controls.
4
Report and review call
Written findings register with risk classification, recommended controls, and a review call to discuss findings and remediation priorities.
Representative deliverable
LLM & AI Agent Security Findings Register + Risk Classification + Recommended Controls
All AI services are request-first. Scope is confirmed in writing before any payment, deposit, or implementation commitment.
Frequently asked questions
Related evidence
Relevant Engineering work
Selected public case records related directly to this service scope. Each record keeps its attribution and disclosure boundary visible.