Frame
Document mission, system boundaries, business impact, authorized techniques and explicit exclusions.
Delx assurance method / v1.0
Security work with a boundary, a burden of proof and an ending.
The method joins organizational risk, agent-specific attack paths and application security verification in one decision-grade record.
Six phases
Map
Model assets, identities, data, tools, trust boundaries, dependencies and plausible adversaries.
Challenge
Exercise the highest-risk paths with safe, proportionate and pre-authorized techniques.
Evidence
Record reproducible proof, affected assets, preconditions, impact and confidence for each finding.
Remediate
Prioritize structural fixes, compensating controls and ownership against real risk.
Verify
Retest the changed behavior and issue a clear record of fixed, accepted and residual risk.
Agentic control plane
Named actors, no ambient trust
Human, service and agent identities are attributable, authenticated and separately authorized.
Least privilege at action time
Tools, resources, spend and side effects are bounded before execution and revocable during it.
Memory is an integrity boundary
Sources, retention, retrieval and writes are governed so hostile context cannot become durable authority.
Safe interruption is a feature
Monitoring, human escalation, kill paths and continuity records support containment and recovery.
What the report says
- Scope, authorization and limitations stated before findings.
- Executive decisions separated from technical evidence.
- Severity based on exploitability, business impact and existing controls.
- Reproduction and remediation guidance proportionate to the risk.
- Verification status for every finding: open, mitigated, fixed or accepted.
- No certification language unless a qualified certification body issued it.