The Security Questionnaire
The review questionnaire covers 8 security groups. Free and Pro see 54 questions; Team sees up to 60 with the SOC 2 and GDPR compliance packs; Enterprise sees up to 62 with the DORA and bias-testing packs. Enforced answers map directly to guardrail rules that CleverGuard checks at runtime; advisory and evidence answers are recorded for reviewers and audit. This page explains every question and what it controls.
The questionnaire is divided into 8 groups, each rendered as one step of the 15-step submission wizard. Each question has a specific input type (Yes/No, multi-select, single-select, number, or free text) and maps to one or more fields in the guardrail profile. The profile is compiled automatically when the submission is approved.
The badge next to each question shows how the answer is used: enforced answers compile into fields that CleverGuard checks at runtime; advisory answers are recorded on the profile for reviewers and audit export but no runtime check reads them; evidenceanswers are compliance attestations. Questions marked with a plan are only shown when your org is on that plan and has the named compliance pack enabled.
Data Flow
These questions tune how CleverGuard scans agent input and output for sensitive data, and what the agent is allowed to touch.
Will this agent process personally identifiable information (PII)?
Guardrail impact: Tunes PII alert severity — PII regex detection always runs regardless of the answer. Answering yes opens D1_types (which PII categories); health records set pii=strict and input handling to redact, financial sets secrets=strict and input to block, biometric sets pii=block.
Which PII types is this agent PERMITTED to process without being flagged?
Guardrail impact: Selected categories are written to allowed_pii_labels and dropped from PII findings at scan time. Only PII findings are affected — injection, secret, scope and exfiltration detection are never weakened. Leave empty to flag all PII.
What types of data will flow through the agent's input/output?
Guardrail impact: credentials/secrets sets secrets=block; customer records raises pii to strict.
Can the agent's output be shown to external users (customers, partners)?
Guardrail impact: If yes, output data handling is set to block so sensitive content is stopped before delivery.
Will the agent need to store or persist any data it processes?
Guardrail impact: Records data_persisted_beyond_session on the privacy section and marks the profile's audit posture as full_content with 365-day retention. The audit_mode and retention_days fields are descriptive — content capture and retention are platform-wide settings, not enforced per agent.
How should Clevername handle API keys detected in prompts?
Guardrail impact: Sets key_interception_mode in scanner config. Keys found in prompts are always removed; this controls whether detected keys are offered for secure storage, stored automatically, stripped silently, or ignored.
What is the maximum data sensitivity level this agent should access?
Guardrail impact: Set to a sensitivity rank from your org's Data Classification Labels. Content with a higher rank is blocked. D8_unrestricted asks you to confirm explicitly if every level should be accessible.
Are there specific sensitivity labels this agent should never access, regardless of rank?
Guardrail impact: Explicitly denies the named labels even when the agent's rank would otherwise allow them.
Does this agent access data belonging to multiple tenants, customers, or organizations?
Guardrail impact: Sets tenant_isolation.multi_tenant and cross_tenant_leak_detection, raises pii to strict, and records the isolation mechanism from D9_isolation.
Data retention per category (one line per type: category | duration | justification)
Guardrail impact: Captured as evidence for GDPR Art. 5(1)(e) storage limitation. Distinct from C4, which covers DLP log retention.
Is any data de-identified or pseudonymised before the agent processes it?
Guardrail impact: Informs scanner strictness. Pseudonymised data still counts as personal data under GDPR.
Tool Scope
Controls which tools, models and code-execution modes the agent may use. Unapproved tools are blocked at the gateway, at the LLM layer, and flagged by the prompt scanner, depending on T6.
Which MCP servers or tool groups is this agent approved to use?
Guardrail impact: Each selection becomes a 'server__*' pattern in allowed_tools (for example github → github__*). T1_schema_pins lets you pin tool schemas. Leave blank to allow all connected servers.
Which LLM models should this agent be allowed to use?
Guardrail impact: Sets allowed_models. Any model not on the list is blocked even if requested. Select at least one.
Should the agent be able to create, modify, or delete data in connected systems?
Guardrail impact: Sets tool_permission_level and the blocked_tools patterns. Read-only blocks create/update/delete/send/publish tools; read-write blocks delete/drop/truncate/remove.
Where should Clevername enforce this agent's tool scope?
Guardrail impact: Sets enforcement_tiers. mcp_gateway blocks the call before the LLM sees it — most accurate. llm_layer strips blocked tools from function-calling payloads. prompt_scan scans system prompt text for scope violations and logs drift — least accurate. Default is mcp_gateway + llm_layer.
How should Clevername respond when drift is detected?
Guardrail impact: Configures the drift response per drift type. Log records silently, Flag notifies admins, Block pauses the agent session.
Does the agent generate or execute code?
Guardrail impact: Sets code_execution. 'No' and 'Generates only' add shell/exec tool patterns to blocked_tools; 'Sandbox' requires static analysis; 'System access' marks the profile for full code-execution monitoring.
Can this agent spawn sub-agents or new sessions?
Guardrail impact: Sets spawn_allowed and, from T9_max_depth, spawn_depth_limit. Without a limit a compromised agent can fork-bomb or create unbounded parallel sessions.
Autonomy & Limits
Sets operational limits. A1–A5, A7–A9 and A11 compile into the circuit breaker and approval gate. A4_notes and A6 are advisory — recorded on the profile, not checked at runtime.
Maximum monthly spend for this agent (USD)
Guardrail impact: Sets budget_limit_usd on the circuit breaker. Agent tasks exceeding the cap are suspended.
Maximum API calls per minute
Guardrail impact: Sets max_calls_per_minute. 'Unlimited with justification' requires a written rationale in A2_justification and compiles to a 10,000/min ceiling.
Maximum session duration
Guardrail impact: Sets max_duration_minutes. Sessions exceeding it are terminated. 'Unlimited with justification' compiles to 24 hours.
Does this agent require human approval before certain actions?
Guardrail impact: When yes, A4_categories captures which action categories need approval. These compile to high_risk_actions_require_approval and high_risk_action_patterns and are routed through SignedApproval before the agent can execute them.
Additional notes on approval requirements
Guardrail impact: Advisory context for reviewers. This text is not injected into the guardrail profile.
How many consecutive errors should trigger an automatic pause?
Guardrail impact: Sets max_errors_before_pause. CleverGuard's circuit breaker pauses the agent and alerts you after this many consecutive failures.
Should the agent be allowed to run unattended (no human monitoring)?
Guardrail impact: Advisory. If no, records require_watcher and auto_pause_after_idle_minutes (15 min default) on the profile for review and audit export. No runtime check reads either field — A3 (max session duration) and A5 (errors before pause) are the enforced pausing controls.
Maximum concurrent parallel sessions for this agent
Guardrail impact: Sets max_concurrent_sessions. Prevents a runaway loop or compromised agent from spawning unlimited concurrent sessions.
Maximum number of records/rows this agent may retrieve or output in a single operation
Guardrail impact: Sets max_records_per_operation and bulk_export_requires_approval. Distinguishes single-record lookups from mass extraction.
Maximum tokens per LLM call
Guardrail impact: Sets max_tokens_per_call. Prevents context-amplification attacks. Leave blank for provider defaults.
Emergency-stop tested?
Guardrail impact: Attestation for EU AI Act Art. 14(4)(e) / ISO 42001 kill-switch testing. Agents with untested stops are surfaced to reviewers.
Does this agent perform destructive operations as part of its normal job (deleting data or files, tearing down infrastructure)?
Guardrail impact: Answer yes only for agents whose real job is destructive (a DBA, migration, cleanup or infra agent). With 'no' (the default), a destructive operation in this agent's tool calls is treated as out-of-mandate — most likely an injected instruction — and alerted on or blocked. 'require_approval' parks each destructive operation for a human.
Network
Controls the agent's network reach and outbound data egress. Prevents unauthorized connections and covert-channel exfiltration.
Should the agent be restricted to specific domains/URLs?
Guardrail impact: If yes, N1_domains populates the domain allowlist. Unlisted domains are blocked.
Does the agent need access to internal/private network resources?
Guardrail impact: If yes, N2_resources captures the specific resources and the profile's audit posture is marked full_content. Access to internal systems requires explicit network-scope approval.
What SSRF (Server-Side Request Forgery) defenses are in place for internal network access?
Guardrail impact: Required when N2 = yes. Without SSRF defenses a prompt injection could reach cloud metadata endpoints or internal services.
Should outputs be blocked from containing URLs?
Guardrail impact: Sets block_urls_in_output. Prevents leaking internal URLs or generating phishing links in output.
Does this agent need to send outbound data to external endpoints? (APIs, webhooks, email, uploads)
Guardrail impact: Sets egress.enabled and, from N4_destinations, allowed_destinations / external_api_allowlist with block_unlisted. Also turns on tool-response scanning and search enforcement.
Which covert-channel defenses should be applied to agent output?
Guardrail impact: Each selected defense closes a specific leak path through seemingly innocuous output. Recommended for most agents: block_markdown_images + strip_encoded_blobs.
Compliance
C4 is asked on every plan. C1–C3 unlock with the SOC 2 compliance pack on Team and Enterprise; C7 with the bias-testing pack on Enterprise.
Which compliance frameworks apply to this agent?
Guardrail impact: Populates compliance.frameworks and tightens scanner settings per framework (HIPAA → pii=block, PCI-DSS → secrets=block, GDPR → pii/output redact, FERPA → pii=strict).
Should all input/output content be logged for audit?
Guardrail impact: Marks the profile's audit posture as full_content with 365-day retention. These fields are descriptive — what is actually captured is a platform-wide setting and is not enforced per agent.
Is there a regulatory requirement for human review of agent outputs before delivery?
Guardrail impact: Advisory. Records output_review_required on the profile for review and audit export. It does not gate output delivery — A4 (high_risk_actions_require_approval) is the field that triggers a SignedApproval push and holds the action until a human approves.
What is the required DLP event retention period?
Guardrail impact: Sets retention_days on the compliance section (custom_with_justification compiles to 365 and asks for C4_custom_justification). Retention is descriptive on the profile — the enforced audit retention is the plan tier (7 / 30 / 365 days / unlimited).
Bias / fairness testing status
Guardrail impact: Attestation required by the EU AI Act, NYC Local Law 144 and the Colorado AI Act. C7_report_url links the report. Agents without recent testing are surfaced to reviewers.
Privacy
Unlocks with the GDPR compliance pack on Team and Enterprise. Org-level privacy questions (data-subject rights, international transfers) are answered once in org settings, not per agent.
Will the agent share user data with third-party services or vendors?
Guardrail impact: Sets privacy.third_party_sharing and marks the audit posture as full_content. Any transfer to external processors must be covered by a DPA.
Could this agent process data belonging to minors?
Guardrail impact: Sets pii=block, adds FERPA to the framework list and records processes_minor_data. PV4_age_band captures the age band (COPPA under 13, GDPR Art. 8 under 16).
Has a DPIA (Data Protection Impact Assessment) been conducted for this agent?
Guardrail impact: Records dpia_status (and PV7_date). DPIAs are mandatory under GDPR Art. 35 for high-risk processing.
Prompt Security
Hardens the agent against prompt injection, output poisoning and system-prompt leakage.
Will this agent accept input from untrusted sources? (User-submitted text, web scraping, email content)
Guardrail impact: Tunes injection-detection sensitivity — detection always runs. Yes sets injection=strict and llm_classification_required.
Will the agent's system prompt contain sensitive instructions? (API keys, internal URLs, business logic)
Guardrail impact: Sets prompt_leakage_detection and llm_classification_required — output is monitored for fragments matching the system prompt.
What should this agent never do? (select all that apply)
Guardrail impact: Each category compiles to a hard constraint in the guardrail profile and is checked at runtime. Use these structured categories for anything that must be enforced.
Additional constraint notes
Guardrail impact: Captured for audit only. This text is not injected into the scanner and is not enforced at runtime.
Will this agent process email or file attachments from untrusted senders?
Guardrail impact: Raises injection to strict. Attackers embed injection payloads in images and attachments.
Can this agent's output be fed as input to another system or agent without human review?
Guardrail impact: Sets output_integrity_check and inter_step_scanning and redacts sensitive output. P6_consumers lists the downstream consumers. Covers multi-step chains and agents whose output triggers automation.
Which prompt-injection encoding defenses should be applied to this agent's inputs?
Guardrail impact: Sets scanner encoding_defenses. Each defense catches a specific keyword-filter bypass family.
Security Context
Primes CleverGuard with agent-specific threat intelligence. Free-text answers here are advisory context; the structured fields next to them are what compile into enforced allowlists and detection rules.
Who is authorized to give this agent instructions?
Guardrail impact: Advisory context for authority-spoofing detection (authorized_sources). Complete S_AUTH_structured for the enforced allowlist.
Authorized instruction sources (structured)
Guardrail impact: Enforced at the session gate. An instruction claiming to come from a source not on this list is flagged as authority spoofing.
What data should this agent NEVER include in its output?
Guardrail impact: Populates never_output in the security context and defines exfiltration boundaries — output matching these descriptions is flagged or blocked. Cross-referenced with P4_categories.
What is this agent's authorized operational scope?
Guardrail impact: Populates operational_scope. Actions outside this declared boundary trigger a drift alert.
What manipulation tactics might target this agent?
Guardrail impact: Populates manipulation_tactics — primes the scanner with attack patterns specific to this agent's threat model.
Expected attack vectors (structured)
Guardrail impact: Each selected vector activates the matching CleverGuard detection rules for this agent.
What does a normal request to this agent look like?
Guardrail impact: Populates normal_request_pattern — a baseline for anomaly detection. Requests that deviate significantly are flagged for review.
What domain-specific terms are normal for this agent?
Guardrail impact: Populates domain_vocabulary to prevent false positives on legitimate business vocabulary. Do not paste credentials, internal URLs or sensitive data here.
Does this agent interact with other AI agents or participate in multi-agent orchestration?
Guardrail impact: Sets multi_agent_orchestration, inter_agent_scanning and allowed_peers (from S7_agents), and raises injection to strict. Multi-agent workflows introduce confused-deputy attack surfaces.
Does this agent spawn other agents or new LLM sessions at runtime?
Guardrail impact: Sets spawn_allowed. Distinct from T9 (spawn authorization): this captures observed runtime behaviour and is compared against T9 by drift detection.
Which peer agents does this agent communicate with at runtime?
Guardrail impact: Used by drift detection to identify undeclared agent-to-agent communication.