Four Surfaces, One Agent: What the Testing Framework Missed Until I Tested the UI
Background The risk-based framework scores and gates test suites. The AI extension does the same for agents and LLM features: prompt injection, disclosure, least privilege, the whole adversarial list. This week I ran both against a real one: a client-facing AI agent sitting on top of a read-only workforce-data API, tested against a plan a colleague had already written. Ten endpoints, one chat window, several thousand rows of other people’s payroll data behind each API key. ...