Where AI agents can use data, tools or delegated authority, examine practical access limits, approvals, action logs, trust boundaries and containment. Specialist security and compliance expertise is involved as warranted. The assessment is scoped and evidence-led, not a claim of independent certification.