Eight tests decide whether your AI agent is a deployment or a demo.

Published in full, with the check for each test and a score sheet for agents nobody commissioned.

In one sentence. The Ryon Standard is a pass or fail gate of eight tests an AI agent must clear before it touches real work.

Written by Eugene, architecture and the safety framework at Ryon. Published 22 September 2026. Last reviewed 22 September 2026. Version 1.0. This page is versioned rather than rewritten, and changes are listed in the changelog at the foot.

The risk everyone ranks first is not the risk breaking systems

OWASP has ranked prompt injection the top risk to AI applications for three years running, most recently on the list released on 4 August 2026. In its own review of eight documented exploits between 1 January and 11 April 2026, prompt injection featured in one. What broke the other seven was permission: agents holding more access than the work needed, identities that could be borrowed, and supply chains nobody had read.

The list is the OWASP Top 10 for LLM Applications, published by a standards body with no commercial interest in the answer. Permission is not a model problem, so no model upgrade closes it. It is settled the day somebody grants an account access, and then nobody looks again. Tests 1, 2 and 6 govern it. Pass all eight and you have a deployment. Fail any and you have a demo. It does not say an agent is accurate, only that it is controllable.

Test 1. Every agent has a named human owner {#test-1}

An agent with no named owner has no one to stop it. Failing it means nobody is on the hook when it misfires. IBM, which sells AI governance software, surveyed 2,000 C level technology executives across 33 geographies for a study published on 8 June 2026, and found two thirds reporting accountability for AI systems they do not fully control. Check it on Monday: open the agent's record and read a person's name.

Test 2. Every action is logged and reconstructable on demand {#test-2}

Logged is not the same as reconstructable. The mechanism is an immutable audit log whose entry names the agent, the action, the input and the approver, so a question asked in November can be answered about a Tuesday in March. Failing it means you can see that something happened and not what it did. Check it by rebuilding one action from last week out of the log alone, without asking the engineer who built it.

Test 3. Autonomy scales with reversibility, and never past it {#test-3}

How much an agent may do on its own is set by how easily the action can be undone, and by nothing else. The tiers are set out in the Four Autonomy Tiers, live 29 September. Failing this test looks like a summarising agent that also has a send button. On an eight week fixed fee pilot for a CySEC licensed investment manager, the contractual acceptance criterion was that the agent must be demonstrated to have sent nothing on its own. Contracted target.

What the agent is allowed to believe, and for how long {#test-4}

<a id="test-5"></a>

Test 4 says all retrieved data is treated as untrusted. Test 5 says every cache entry expires, and personal data is never cached. Together they decide what the agent is allowed to believe, and for how long. A document in a shared folder is an input, not a fact, and yesterday's answer is not today's. The OWASP Gen AI Exploit Round up of 14 April 2026 counted roughly 12,000 to 15,000 Flowise instances exposed during active exploitation of CVE-2025-59528. Those systems were reachable, and what they held was trusted. Test 4 needs a mechanism behind it, and this is the one.

On Ryon's own due diligence engine, measured on its reference corpus of roughly 10,900 locator tagged chunks across 10 sources, the hallucinated citation rate is zero by construction. Every extracted fact carries a citation locator and every graph edge is confirmed by a real source chunk, so an uncited claim cannot be produced. Measured, on that corpus and in that build. It is a property of the architecture, not an accuracy score. It says nothing about whether an answer is correct, and it does not transfer to any other system, including any system Ryon builds for you.

Test 6. The agent holds the least privilege that still works {#test-6}

Least privilege is the test most estates fail quietly, because nobody grants too much on purpose. Three controls carry it: least privilege itself, the audit log behind test 2, and a kill switch a named owner can reach.

One of the agents Ryon built was never given delete permission. Not restricted, not logged, not approved on request. It does not have the permission at all, and the account it runs under cannot be granted it without a change that two people have to sign. The client asked for delete twice in the first month, because the workflow looked easier with it. The answer both times was that an agent which cannot delete cannot destroy evidence of what it did, and that this matters more on the day something goes wrong than it costs on the days nothing does.

Test 7. Low confidence escalates to a human automatically {#test-7}

A confident wrong answer costs more than no answer. The mechanism is a confidence threshold that routes to a named queue, and abstention when the system cannot ground an answer. Not found is a first class answer. Failing this test means the low confidence cases are the ones nobody ever sees. Check it by finding the queue, counting what is in it, and asking who reads it.

Test 8. The agent is red teamed on a schedule, not once at launch {#test-8}

An agent that passed on launch day has only been tested against the systems it had on launch day. Red teaming on a schedule catches the connector added in June and the permission widened in August. The ongoing check is the monthly accuracy run, live 13 October. Failing this test means your evidence of safety has a date on it and the date is old.

Score your own estate in one afternoon

1. Count the agents nobody commissioned. Include the one somebody in finance built in a low code tool, the browser extension nobody logged, and the scheduled script that emails a summary every Friday. You are counting, not judging.

2. For each one, name the human owner. A team is not a name and a job title is not a name. If there is no name, you have found the failure before you have found the cost.

3. Can you reconstruct what it did last Tuesday. Pick the Tuesday before you look, so you do not pick a quiet one. Work from the log, not from memory and not from the person who built it.

4. What permission does it hold, and does it still need it. One agent needed read access to a shared drive in March. It was granted write access, because write was the default in the tool. It still holds it in September. The permission was never wrong on the day it was granted, which is why nobody reviews it.

5. Place the estate on the maturity ladder. Sandbox. Copilot. Act with approval. Bounded autonomy. For most firms copilot is the right rung this year, and moving off it in the next twelve months would be a mistake.

6. Run the two qualification tests over every proposal on the roadmap. Does it change a decision. Does it remove real work. If both answers are no, decline it before somebody funds it.

Ryon runs on two verticals. Client staff build the simple agents. Ryon's engineers build the sensitive and complex ones. Neither side does everything.

The self scoring checklist ships attached to this page, as its own artefact and not as an offer. Most of what a competitor published is still only announced, which is the subject of announced is not deployed, live 24 September.

Provider or deployer, and which tests each one triggers

Ryon classifies every agent in a client estate as one of two things, because the two carry different work. A provider agent is one the client built or commissioned, where the client controls the model, the prompts and the connectors. It triggers all eight tests. A deployer agent is one bought from a vendor and configured, where the client controls access and use. It triggers tests 1, 2, 6 and 7, and test 8 moves to a question the client puts to the vendor in writing. This is how Ryon scopes work. It is not a view on what any instrument requires of you.

What passing looked like, in two engagements

Ryon has delivered 30+ AI agents across 11 industries and 40+ live system integrations, delivered, deployed or contracted in the past twelve months, across Europe, the UK, the US and the Gulf. Results vary by client. Measured. Two of those engagements are set out here, and the rest sit in the Ryon Use Case Library, live 6 October.

One was the CySEC licensed investment management pilot, already stated at test 3.

The other was a private markets engagement where the work was file compliance. File compliance was measured at the start against the client's own records and held at 90% for three consecutive weeks. Measured, baselined against that client's own numbers before the work started. Three weeks is the number that matters, not the 90%, because a compliance figure that holds for one week is a good week.

Confidentiality. Client names are withheld. The architecture, the guardrails and the measured or contracted targets are exactly as they were. Where a number is a target rather than a result, it says so.

What the Ryon Standard does not do

The Ryon Standard does not certify a model. Model behaviour changes with a version, a temperature setting and a system prompt, and a certificate issued against one build is worth nothing against the next. It does not replace a conformity assessment. A conformity assessment is a procedure defined by an instrument and carried out by the parties that instrument names, and passing eight engineering tests is not that procedure. And it does not say an agent is accurate, only that it is controllable. An agent can clear all eight tests and still be wrong about the thing you asked it. It will be wrong in a way somebody owns, inside a log you can read, with a permission it cannot exceed.

How do I tell if an AI agent is production ready

An AI agent is production ready when it clears all eight tests in this Standard and not before. Three decide most cases: a named human owner, a log you can reconstruct any action from, and a permission set matched to the work. If one fails, stop measuring the rest.

How do we test an agent for hallucination before go live

With a method, not a number. Build a fixed question set with known answers, run monthly accuracy runs against it, and verify a test set by hand before anything applies automatically. Then check that the system abstains when it cannot ground an answer, rather than filling the gap.

What is the difference between an AI pilot and an AI deployment

A pilot proves the thing can work. A deployment proves it can keep working when nobody is watching. The difference is not scale, it is control: an owner, a log, a permission boundary and a red team schedule. A pilot that clears all eight tests is a deployment running at small volume.

Version and changelog

Version 1.0, published 22 September 2026. There is no changelog yet, because nothing has changed. When a test is reworded, added or removed, the old wording stays here with its date. A standard a buyer can cite by version is worth more than a checklist a vendor can quietly edit.

How the numbers on this page are labelled. Every number about Ryon on this page carries one of five labels. Measured means observed in a delivered engagement. Contracted target means written into a contract as an acceptance criterion. Designed target means designed and not yet measured. Published product claim means a forward looking claim about a Ryon product, not a client outcome. Comparable build means observed on a similar build rather than this one.

The baseline. Every Ryon engagement is baselined against the client's own numbers before the work starts. Every figure on this page is measured against that client's starting position, not against an industry average.

The external sources. Where a number below comes from a firm that sells the thing the number is about, this page says so in the same sentence. Where it comes from a regulator, a university or a standards body with no commercial interest in the answer, it says that too.

Legal. Ryon is an engineering firm, not a law firm. Nothing on this page is legal advice. Every regulatory date and obligation here is reported from the primary source named beside it and linked from it, and it was accurate on the date this page was last updated. Whether any of it reaches your business depends on facts we do not have. Take your own legal advice before you rely on it.

Book the free 2 hour diagnostic. Two hours, a one page opportunity map, and a straight answer on whether to wait.

Sources

1. OWASP Gen AI Security Project, LLM01 Prompt Injection, ranked first in the OWASP Top 10 for LLM Applications. Standards body, no commercial interest in the answer. 2026 list released 4 August 2026. https://genai.owasp.org/llmrisk/llm01-prompt-injection/

2. SD Times, report that prompt injection tops the 2026 OWASP GenAI and LLM Top Ten, 4 August 2026. Cited for the release date of the 2026 list. https://sdtimes.com/security/prompt-injection-tops-2026-owasp-genai-llm-top-ten-vulnerabilities/

3. OWASP Gen AI Security Project, Gen AI Exploit Round up Report, first quarter 2026. Sample: eight major GenAI and agentic exploits documented between 1 January and 11 April 2026. Source of the Flowise exposure figure and CVE-2025-59528. Standards body, no commercial interest in the answer. Published 14 April 2026. https://genai.owasp.org/2026/04/14/owasp-genai-exploit-round-up-report-q1-2026/

4. IBM Institute for Business Value, CIO and CTO study. Sample: 2,000 C level technology executives, 33 geographies, 19 industries, fielded January to April 2026. IBM sells AI governance software. Published 8 June 2026. https://newsroom.ibm.com/2026-06-08-new-ibm-study-finds-cios-and-ctos-face-growing-ai-control-gap-as-enterprise-deployment-scales