Before your agent can move money, prove what it is allowed to do.
What is a preflight authority workbench?
Threswarda is a preflight authority workbench for production AI agents. It runs one workflow family — refund issuance, with invoice recovery and write-offs as variants — through 20 deterministic scenarios against one canonical policy schema and one genuinely executable policy target, and shows you exactly where authority stops, where the money ceilings are, and what happens when they are missing, mis-denominated, or set to only alert.
Open the workbench Browse the 20 scenarios
What the workbench actually tests
Authority boundaries
Every action is bound to a principal — the party on whose authority the agent acted — through a grant and an authority chain. Expired grants, over-broad delegations, missing approvals, denied approvals, post-hoc approvals, and replayed instructions are exercised as first-class failures, not edge cases.
Two economic exposures, always
Every scenario tracks both the loop cost of the agent's own computation and the cumulative refund dollars it can move. A ceiling may fire, only alert, or be absent — the module records which, in dollars, never in token counts dressed up as limits.
Signed evidence, two artefacts
Each run produces a hash-chained, signed audit session aligned to the current agent audit-trail draft. From that one record, platform/security gets the executable policy and the harness pass receipt (Artifact A); finance/risk gets the signed evidence packet (Artifact B). Neither contains the other's working material.
Why this exists — the evidence we are allowed to cite
Our corpus rules are strict: a figure ships only when it resolves to a primary source we have read, or it is labelled a synthetic model with its math shown. The incident that motivates the loop-cost module is an operator's own published account of four cooperating agents, two of which stayed in an unbroken conversation loop for days. The headline total attached to that account does not close against its own itemised weekly figures, so we do not repeat it. The itemised figures are:
The loop event, cited as its primary's itemisation: $25,658
Week 1: $127 · Week 2: $891 · Week 3: $6,240 · Week 4: $18,400 — itemised total $25,658. Source: Teja Kusireddy, Towards AI, 16 Oct 2025 — the primary operator account of the incident. The itemisation is the primary's own; its headline total is not repeated here, because it does not close against this itemisation — and wherever we cite the event, the discrepancy is discussed as a discrepancy, with the math shown.
Evidence class: first-person participant testimony; the team is unnamed and the figures are unaudited. Admissible with those caveats attached. Last verified 2026-10-28. Scenario S16 in the library is a synthetic model built from this itemisation.
What the episode shows is not that agents are expensive. It is that no dollar ceiling fired — because none existed. Frameworks overwhelmingly ship token and step limits; a token limit is not a dollar ceiling, and Threswarda reports it as exactly that: absent.
The record format
Run records implement the mandatory core of
draft-sharif-agent-audit-trail-09
— 13 mandatory fields, including the principal object on every record — with hashes
chained over RFC 8785 (JCS) canonical JSON and ES256 signatures. The draft is an individual
Internet-Draft: work in progress, not an IETF standard, and we cite it as such, revision and all.
Integrity language, because it matters: hashes and signatures prove a record was not altered after it was signed, and — with sequence-number continuity — the completeness of the record sequence. They do not prove the truth of the underlying events, and they are not a third-party attestation. Regulatory dates we cite follow the draft's mapping to the EU AI Act as amended: Article 12 logging obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I regulated products).
The buyer split
Finance owns refund outcomes; platform and security own runtime policy. A single combined export would serve neither. So the split is a boundary, not a formatting choice: Artifact A is generated from an allowlist that cannot emit dollar exposure totals; Artifact B from an allowlist that cannot emit policy source. Both carry one identity block, and each identity block commits to the counterpart artefact's head hash — so a buyer who later receives the counterpart can confirm it is the artefact the packet committed to, and detect if it has changed. Proving anything about the counterpart requires holding it: the commitment alone does not prove an unseen artefact exists.