1. Action family
Every action maps to one of four families: READ, WRITE, DELETE or EXPORT. Sending (an email, a message, a webhook) and updates count as WRITE; the destination decides the rest.
Framework
Agent Action Risk Framework
How risky is the thing your agent is about to do? Three questions cover most of it: what kind of action, where the data goes, and how much of it. This is the model the Vulnify engine scores with, published so you can reason about it, use it in your own reviews, or argue with it.
The three axes
2. Destination
Internal or external. External means it leaves the organization: a personal mailbox, a public URL, a third-party API. Mail to a business domain and private hosts are treated as internal.
3. Volume
How many records the action touches. One row is a mistake; 48,000 rows is an incident. The engine steps up above 100, 1,000 and 10,000 records.
Score and verdict
Points add up to a 0–100 score. 0–49 is ALLOW, 50–74 is REVIEW (a different person approves or denies), 75 and above is BLOCK. Each factor that fires is returned as a reason, word for word as below.
| Factor | Points | Reason returned |
|---|---|---|
| Action family | READ 5 · WRITE 15 · DELETE 30 · EXPORT 30 | Read operation, Write operation, Delete operation, Export operation |
| Sensitive data (customer PII, financial, employee, sensitive), or sensitive data found in the content | +25 | Customer PII · Financial data · Employee data · Sensitive data · Sensitive data detected in content |
| Sensitive personal data under LGPD art. 11 found in the content (health, biometrics…) | +10 | Sensitive personal data under LGPD art. 11 |
| External destination: an EXTERNAL_* type, a personal mailbox (Gmail, Outlook…) or a URL on a public host | +25 | External destination |
| An API key or private key in content going to an external destination | +20 | Secret or credential sent to an external destination |
| The agent edits its own permission or tool configuration | +35 | Agent permission change |
| Recursive or wildcard file deletion (rm -rf, find -delete…) | +20 | Recursive or wildcard file deletion |
| Volume: more than 100 / 1,000 / 10,000 records | +10 / +20 / +30 | Large data volume (N records) |
| Outside business hours (optional, off by default) | +10 | Outside business hours |
The matrix: data that is not sensitive
| Action family | Destination | 1–100 records | 101–1,000 | 1,001–10,000 | over 10,000 |
|---|---|---|---|---|---|
| READ | Internal | ALLOW 5 | ALLOW 15 | ALLOW 25 | ALLOW 35 |
| READ | External | ALLOW 30 | ALLOW 40 | REVIEW 50 | REVIEW 60 |
| WRITE | Internal | ALLOW 15 | ALLOW 25 | ALLOW 35 | ALLOW 45 |
| WRITE | External | ALLOW 40 | REVIEW 50 | REVIEW 60 | REVIEW 70 |
| DELETE | Internal | ALLOW 30 | ALLOW 40 | REVIEW 50 | REVIEW 60 |
| DELETE | External | REVIEW 55 | REVIEW 65 | BLOCK 75 | BLOCK 85 |
| EXPORT | Internal | ALLOW 30 | ALLOW 40 | REVIEW 50 | REVIEW 60 |
| EXPORT | External | REVIEW 55 | REVIEW 65 | BLOCK 75 | BLOCK 85 |
The matrix: sensitive or personal data
| Action family | Destination | 1–100 records | 101–1,000 | 1,001–10,000 | over 10,000 |
|---|---|---|---|---|---|
| READ | Internal | ALLOW 30 | ALLOW 40 | REVIEW 50 | REVIEW 60 |
| READ | External | REVIEW 55 | REVIEW 65 | BLOCK 75 | BLOCK 85 |
| WRITE | Internal | ALLOW 40 | REVIEW 50 | REVIEW 60 | REVIEW 70 |
| WRITE | External | REVIEW 65 | BLOCK 75 | BLOCK 85 | BLOCK 95 |
| DELETE | Internal | REVIEW 55 | REVIEW 65 | BLOCK 75 | BLOCK 85 |
| DELETE | External | BLOCK 80 | BLOCK 90 | BLOCK 100 | BLOCK 100 |
| EXPORT | Internal | REVIEW 55 | REVIEW 65 | BLOCK 75 | BLOCK 85 |
| EXPORT | External | BLOCK 80 | BLOCK 90 | BLOCK 100 | BLOCK 100 |
Base engine only. Your policies can raise or lower any verdict, monitor mode records the verdict without enforcing it, and a paused or disabled agent is always blocked. Credentials, agent permission changes and recursive deletes add points on top of these tables.
Try a cell
Run any row on the playground, no signup, and see the score and the reasons. Or see how this maps to OWASP, the EU AI Act and LGPD.