A banking chatbot reveals another customer’s statement. A read-only user changes a payment destination through the same chat. These banking examples show why an assistant’s permissions matter. Here is how Ostorlab’s Agentic Deep Scan investigates the boundary behind each failure.

Agentic Deep Scan connects the assessment’s mobile app, API schemas, source code, documentation, and web interfaces to the assistant’s entry point. Test accounts and workflow guidance establish an authenticated conversation. The investigation follows the assistant through the app, browser, and API so testing matches how people use it.

Testing preserves the request, authentication, tenant, session, and conversation history. Browser execution handles browser-dependent flows. HTTP execution handles replayable requests. Streaming answers must finish before conclusions are drawn. Compare a baseline, a targeted probe, and a matched control. Repeat decisive comparisons in fresh sessions.

In the Northstar Bank example, customer A owns a private statement. Customer B’s direct request returns forbidden. Through the chatbot, B obtains the closing balance of eighty-four thousand two hundred fifty euros and the protected statement reference. Separate sessions and retrieval records connect the response to A’s statement and establish the access-control failure.

Next, a read-only user asks the chatbot to change a test beneficiary’s destination. The direct API refuses, while the assistant’s delegated tool performs the update. A server execution record and an independent read confirm the stored destination. The owner restores it, giving the investigation a complete record of the action and its cleanup.

For prompt injection, the customer asks how to freeze a card. The original help article explains the normal app workflow. An attacker-controlled paragraph tells the assistant to claim card freezing is unavailable. Keep the customer’s question unchanged, verify the poisoned source was retrieved, and restore it. The comparison tests whether source text gained instruction authority.

Agentic Deep Scan connects each finding to application evidence. For disclosure, the report preserves source permissions and the exact protected value returned. For tool actions, it correlates the initiating user, execution records, and persisted state. Requests, responses, matched controls, and cleanup form a reproduction path your engineering team can follow.

The fixes follow the boundary. Authorize private sources before retrieval. Check every tool action against the initiating user and resource. Treat retrieved instructions as untrusted content, and keep service privileges narrow. Then repeat the same controlled tests to verify that the demonstrated failure is closed.

The report turns the investigation into an actionable finding. Redacted transcripts, matched controls, source or tool evidence, and clear reproduction steps explain the demonstrated impact. Remediation guidance shows where to enforce the boundary. Your team can trace the result, reproduce the failure, apply the fix, and verify the changed behavior.

To prepare an assessment, supply the assistant workflow, test accounts, permission rules, scope, and safe test resources. Agentic Deep Scan connects discovery, controlled tests, and application evidence to a reproduction path your team can review and fix.