Premise 01
An agent is a principal.
If an agent can read data or change state, it needs a distinct identity—not a shared application credential that erases who did what.
Sovereign AI security · International
Your AI agents can act. Who authorized them?
Most agents run on a shared credential and a system prompt. Averon gives every agent its own identity, enforces policy before a request reaches your tools and data, detects hostile instructions, and proves the whole deployment holds through adversarial penetration testing, inside the jurisdiction and data boundary you choose.
Control pathAVR / MCP
Identity
One identity per agentNo shared agent identity.
Permissions
Tools · data · actions
Policy
Managed per agent
Enforcement
At the MCP boundaryBefore the request reaches the target.
Sovereignty
Client-selected boundaryOn-premise, sovereign cloud, or isolated regional tenancy.
Testing
Adversarial penetration testing
Premise 02
A prompt is not a policy.
Instructions inside model context can guide behaviour. They cannot reliably authorize access to tools, data, or actions.
Premise 03
Enforcement must sit in the path.
A control only holds when every relevant request crosses a gate that can allow or deny it before execution.
Sovereign AI security / Any jurisdiction
Security built around jurisdiction, authority, and evidence.
Averon supports AI deployments in the GCC and internationally. Wherever the system runs, the delivery model follows the client’s approved jurisdiction, data-residency requirements, and access controls.
Sovereignty
Keep data and evidence inside the approved boundary
Deploy controls and conduct testing in the client environment, an approved sovereign cloud, an isolated regional tenancy, or an air-gapped environment.
Adversarial testing
Penetration testing for the whole AI system
Test prompt injection, data exfiltration, retrieval, identity, authorization, agent tools, MCP servers, model supply chain, and detection coverage as connected attack paths.
Local evidence
Evidence mapped to your control context
Produce technical, executive, and assurance evidence under a client-approved handling plan, with applicable national and sector control mapping defined in scope.
01 / Agent control
A control layer between agents and capability.
Averon makes agent authority explicit. Identity establishes who the agent is. Permissions define its available surface. Policy evaluates the requested operation. The MCP enforcement gate makes the decision effective.
AVR-IDIdentity
A distinct identity for every agent
Separate agents from shared service identities so authority can be assigned to the actual actor rather than an undifferentiated application account.
Principal before privilege
AVR-PMPermissions
Scope tools, data, and actions
Express what each agent may reach and what it may do. Access is defined around the agent and the capability, not buried in prompt text.
Least authority by design
AVR-PEPolicy
Manage policy per agent
Apply a policy set to each agent for its permitted tools, data and actions, creating a deliberate boundary around every deployment.
Policy outside the model
AVR-MCPEnforcement
Decide at the MCP boundary
Place the authorization decision directly in the path between the agent and MCP-exposed capability, before the target tool, data source, or action is reached.
Allow or deny before execution
02 / Decision path
The model requests. Averon decides. MCP enforces.
The model does not grant itself authority. A request is evaluated against the identity and policy of the calling agent before the MCP server or downstream capability receives it.
The boundary
Agent identity and policy stay outside model context. A successful prompt injection cannot rewrite an enforcement decision that the model does not control.
Authorization sequenceAVR-MCP-01
01 / Identify
Agent presents its identity
The request is attributable to one agent rather than a shared application principal.
02 / Evaluate
Policy evaluates capability
The requested tool, data, and action are checked against that agent’s policy.
03 / Enforce
MCP gate allows or denies
Only an allowed request proceeds to the downstream system.
A conceptual control flow. Exact policy structure is scoped to the agent deployment.
03 / Averon IntelliScan
Detect hostile instructions before they become agent behaviour.
IntelliScan screens agent inputs for prompt-injection and excessive-reasoning risk. Suspicious cases are flagged and can be escalated through deeper review tiers.
Input screening
Prompt-injection detection
Inspect instructions entering the agent path and flag content that attempts to override, redirect, or manipulate expected behaviour.
Explore IntelliScan →Tiered review
Escalation for higher-risk checks
Use fast screening for volume and escalate flagged cases to progressively deeper analysis under the selected plan.
View plans →04 / Independent assurance
Control the agent. Then test the entire deployment adversarially.
Averon performs AI adversarial penetration testing before deployment and continuous assurance after launch across prompt injection, data exfiltration, tool abuse, model supply chain, and broken authorization.
This work tests the AI system as it actually operates: model, retrieval, identity plumbing, tools, and evidence. It can stand alone or examine the controls around an Averon deployment.
Assurance scope
From architecture to consequence
- Pre-deployment AI adversarial penetration testing.
- Continuous, change-driven re-testing.
- Identity and entitlement differential testing.
- Tool, retrieval, and prompt-injection attack paths.
- Technical and executive evidence.
05 / Public research
A security product informed by offensive evidence.
Averon’s research has entered coordinated public disclosure through CERT/CC, including authorization failures that exposed data across application boundaries.
CERT/CC Vulnerability Note
VU#849433 — cross-application data extraction through broken authorization
Published 08 July 2026. Reporter: Saud Darwish. Coordinated by CERT/CC.
Bring authority under control
Start with one agent, its tools, and the actions that matter.
We will map the agent identity, capability surface, and MCP enforcement point with your technical team.