The Security Questionnaire
The review questionnaire covers 8 security domains with 43 questions. Each answer directly maps to a guardrail rule that CleverGuard enforces at runtime. This page explains every question and what it controls.
The questionnaire is divided into 8 groups. Each question has a specific input type (Yes/No, multi-select, single-select, number, or free text) and maps to one or more fields in the guardrail profile. The profile is compiled automatically when the submission is approved.
Data Flow & Content Scanning
These questions determine how aggressively CleverGuard scans agent input and output for sensitive data.
Will this agent process personally identifiable information (PII)?
Guardrail impact: Enables strict ML-based PII scanning.
Will this agent handle protected health information (PHI)?
Guardrail impact: Enables strict PII scanning, sets input data handling to 'redact', and flags HIPAA compliance.
Will this agent access financial data?
Guardrail impact: Enables strict secrets scanning and sets input data handling to 'block'.
What types of data will flow through the agent?
Guardrail impact: Sets category-specific scanner profiles.
Can the agent's output be shown to external users?
Guardrail impact: If yes, enables output data handling to 'block' to prevent PII leakage.
Will the agent need to store or persist data?
Guardrail impact: Enables full-content audit mode and sets retention to the maximum configured period.
How should Clevername handle API keys detected in prompts?
Guardrail impact: Sets key_interception_mode in scanner config. Controls whether detected keys are offered for storage, auto-stored, stripped silently, or ignored.
Tool & Model Scope
Controls which tools, models, and APIs the agent can access. Unapproved tools are blocked at the gateway, at the MCP call level, and at the prompt level.
Which MCP servers or tool groups is this agent approved to use?
Guardrail impact: Each entry compiles to a 'server__*' allowlist pattern enforced at three layers: (1) Clevername MCP blocks the call before it reaches the LLM, (2) the LLM layer strips unapproved tool definitions from function-calling payloads, (3) the prompt scanner flags system prompts referencing blocked capabilities. Leave blank for no restriction.
Which LLM models should this agent be allowed to use?
Guardrail impact: Sets allowed_models list. Any model not selected is blocked even if requested.
Where should Clevername enforce this agent's tool scope?
Guardrail impact: Controls which enforcement tiers are active. mcp_gateway (Tier C) blocks tool calls at the Clevername MCP layer — most accurate, can't be bypassed. llm_layer (Tier B) strips blocked tools from function-calling payloads before the LLM sees them — works even when the agent uses its own MCP. prompt_scan (Tier A) scans system prompt text for scope violations and logs drift events — least accurate, warn-only. Default is mcp_gateway + llm_layer.
Does the agent need external API access beyond approved tools?
Guardrail impact: If yes, opens a follow-up for listing allowed API endpoints.
Should the agent be able to create, modify, or delete data?
Guardrail impact: Sets tool_permission_level. Read-only blocks all write/delete tools.
Autonomy & Budget
Sets operational limits. A1–A5 are enforced automatically by CleverGuard's circuit breaker and the approval gate. A6 is advisory — recorded on the profile, not checked at runtime.
Maximum monthly spend for this agent (USD)
Guardrail impact: Sets budget_limit_usd. Agent tasks exceeding this are suspended.
Maximum API calls per minute
Guardrail impact: Sets max_calls_per_minute rate limit.
Maximum session duration
Guardrail impact: Sets max_duration_minutes. Sessions exceeding this are terminated.
Does this agent require human approval before certain actions?
Guardrail impact: When yes, follow-up A4a captures which actions need approval (e.g., 'delete_customer', 'send_email'). These are routed through SignedApproval for push-based human approval before the agent can execute.
Consecutive errors before auto-pause
Guardrail impact: Sets max_errors_before_pause circuit breaker threshold.
Allow unattended execution?
Guardrail impact: Advisory. If no, records require_watcher and auto_pause_after_idle_minutes (15 min default) on the profile for review and audit export. No runtime check reads either field — A3 (max session duration) and A5 (errors before pause) are the enforced pausing controls.
Network & Access
Controls the agent's network reach. Prevents unauthorized outbound connections and data exfiltration.
Should the agent be restricted to specific domains/URLs?
Guardrail impact: If yes, sets url_allowlist. Unlisted domains are blocked.
Does the agent need access to internal/private network resources?
Guardrail impact: If yes, enables full-content audit mode and network monitoring. Follow-up captures specific resources.
Should outputs be blocked from containing URLs?
Guardrail impact: Enables a custom content rule that strips URLs from agent output to prevent data exfiltration.
Compliance & Audit
Maps regulatory requirements to scanner profiles, audit settings, and retention policies.
Which compliance frameworks apply?
Guardrail impact: Auto-enables framework-specific scanner profiles and retention overrides.
Should all input/output content be logged for audit?
Guardrail impact: Sets audit_mode to 'full_content' and retention_days to 365.
Is human review of outputs required before delivery?
Guardrail impact: Advisory. Records output_review_required on the profile for review and audit export. It does not gate output delivery — A4 (high_risk_actions_require_approval) is the field that triggers a SignedApproval push and holds the action until a human approves.
Required DLP event retention period
Guardrail impact: Sets retention_days for DLP scan events and content logs.
Data subject to data residency requirements?
Guardrail impact: Flags data residency constraints. Affects which LLM endpoints can be used.
Subject to AI-specific regulations?
Guardrail impact: Flags EU AI Act / NIST AI RMF requirements for conformity assessments and human oversight.
Privacy
Assesses data privacy obligations under GDPR, CCPA, COPPA, and other privacy regulations.
Is personal data stored or logged beyond the session?
Guardrail impact: Triggers retention and deletion obligation tracking.
Will user data be shared with third-party services?
Guardrail impact: Flags Data Processing Agreement (DPA) requirements.
Must the agent honor data deletion or opt-out requests?
Guardrail impact: Implies a deletion workflow must exist (GDPR Art. 17, CCPA).
Could this agent process data belonging to minors?
Guardrail impact: Flags COPPA (under 13) and GDPR Art. 8 (under 16) parental consent requirements.
Does the agent transfer data across international borders?
Guardrail impact: Flags Standard Contractual Clauses (SCCs) or adequacy requirements under GDPR.
Will the agent build user profiles or scoring systems?
Guardrail impact: Flags GDPR Art. 22 automated profiling consent requirements.
Has a Privacy Impact Assessment (PIA/DPIA) been conducted?
Guardrail impact: Flags DPIA status for high-risk processing activities.
Prompt Security
Hardens the agent against prompt injection, data poisoning, and system prompt leakage.
Will the agent accept input from untrusted sources?
Guardrail impact: Enables strict injection scanning and LLM-based classification for every input.
Does the agent process multi-step workflows?
Guardrail impact: Enables inter-step scanning — output from each step is scanned before being fed to the next.
Does the system prompt contain sensitive instructions?
Guardrail impact: Enables prompt leakage detection — monitors output for fragments matching the system prompt.
Describe what this agent must never do.
Guardrail impact: Injected verbatim as a hard constraint into CleverGuard's AI content scanner. Checked against every input/output in real time.
Security Context
Provides CleverGuard with agent-specific threat intelligence. These free-text answers prime the scanner with contextual knowledge about who uses this agent, what it should never reveal, and what normal vs suspicious looks like.
Who is authorized to give this agent instructions?
Guardrail impact: Populates authorized_sources in security context. Helps detect authority spoofing — instructions claiming to come from unlisted sources are flagged.
What data should this agent NEVER include in its output?
Guardrail impact: Populates never_output in security context. Defines exfiltration boundaries — output matching these descriptions is flagged or blocked.
What is this agent's authorized operational scope?
Guardrail impact: Populates operational_scope in security context. Actions outside this declared boundary trigger drift alerts.
What manipulation tactics might target this agent?
Guardrail impact: Populates manipulation_tactics in security context. Primes the scanner with attack patterns specific to this agent's threat model.
What does a normal request to this agent look like?
Guardrail impact: Populates normal_request_pattern in security context. Establishes a baseline for anomaly detection — significant deviations are flagged.
What domain-specific terms are normal for this agent?
Guardrail impact: Populates domain_vocabulary in security context. Prevents false positives on legitimate business vocabulary that might otherwise look suspicious.