Scan in. Blast radius out.
Most of what your agent can do, you want. The scanner shows you the part you don't, without touching anything.
MANDATEsupport tickets
email any domainexport the CRMrefund any amountattach any filereadreplysearchdraftatbash scan · laptop + cloud3 agents found
support-agent
tools: email, crm, payments · plugins: 4 · skills: 9 · memory: 2
WORKFLOWS IT CAN DO FOR YOU✓ answer tickets✓ refund small orders✓ log calls to CRM
AUTHORITY NO WORKFLOW NEEDS× email any domain× attach any file× export the CRM× refund any amount
Policy generated · 4 red linesUseAdjustWrite your own
example reportWhat it reads
Everything that gives your agent reach
01
Tools
Every action the agent can call: send, pay, deploy, delete.
02
Skills
What those tools add up to once they are combined.
03
Plugins
Extensions loaded into the agent, with their own reach.
04
Context files
Documents the agent was given to work from.
05
Memory
What it remembers between sessions.
What it returns
A report you can act on in minutes
Workflows it can already run
Capability is the asset. The scan lists what your stack can safely automate.
Revenue retentionREADY
Finance operationsNEARLY
Contract executionNEARLY
Authority beyond the mandate
Ranked by what it would cost you if it happened.
Export the CRMCritical
Refund any amountVery important
Email any domainImportant
Authority Exposure
One number, 0 to 100. Apply red lines and watch it drop.
92
34
READ-ONLY BY DESIGN
What the scan never does
Scan mode is clearly read-only, shown before any permission step.
×Executes an action
×Changes your configuration
×Needs enforcement permissions
×Asks for seed phrases or private keys