NO GUARANTEE. This kit gathers and structures evidence, control by control; it documents your posture, it does not prove your agents are secure and is not a guarantee of any security outcome. It is a verification aid, not security, legal, or compliance advice. READ-ONLY ASSESSMENT SCRIPTS BY DESIGN. The four assessment scripts inspect posture and make no configuration or data changes; we do not ship attack or destructive-test scripts. That is the AI-prepares-humans-decide boundary as a feature: the tool prepares the finding, a human decides and acts. The verification kit's behavioral probes (the prompt-injection test and the destructive-action gate test) are different: they are active tests that send live prompts and can trigger agent actions, so run them against a non-production or explicitly consented agent, never blind against production. Refund expectation, stated up front so you can self-select out: if you came for a script that deletes mail, changes a permission, or exercises an attack, this is not that product and never will be. Buy it to document and structure your posture control by control, not to break something. Your people are spinning up Copilot agents, and the board wants to know what stops one from wiping a mailbox, leaking data, or being hijacked by a poisoned document. Microsoft's docs are scattered and read like marketing. A practitioner probe that returns ContentFiltered tells you a filter fired, not what it stopped. You need a defensible account you can hand a risk committee, and a way to gather evidence for each control in your own tenant instead of trusting a settings screenshot. This is the audit instrument for exactly that. The centerpiece is a verification kit: eight per-control test cards, numbered T1 to T8 consistently with the scripts, that each tell you what to test, the steps sourced to a named Microsoft or standards page, what a PASS looks like, what a FAIL means, and where to go to fix it. Alongside it, a one-page board answer to the mailbox-wipe question, written so a CISO can read it straight into a minute. The four read-only assessment scripts (plus the free sample) are accelerators that turn the kit from a document into an instrument: they gather the evidence, you make the call. Every claim is stamped and traces to an authoritative source. The documentary claims are stamped as of July 2026; the live-tenant measurements, which are the parts that say "this field was absent" or "this run produced no false negatives", are stamped 15 to 18 August 2026 and dated in place wherever they appear. Two dates because they are two kinds of evidence, and collapsing them into one would hide which is which. Sources: Microsoft Learn, MSRC, the NVD record for EchoLeak (CVE-2025-32711) with its 9.3 Critical attributed to Microsoft as the CNA rather than to NVD, whose own base score for it is 7.5 High, OWASP LLM Top 10 2025, MITRE ATLAS v5.4.0 (Feb 2026), and NIST AI 600-1. The crosswalk that maps each threat to its OWASP entry, ATLAS technique ID, NIST category, and mitigating Microsoft control ships inside the kit as a static reference table; those mappings are interpretive crosswalks, not primary facts. This is a vendor-neutral briefing from an independent practitioner. Microsoft is cited as a source, never cheered, and each control is described with its residual risk named. The recurring governance position, and the reason the scripts stop where they stop: AI prepares, humans decide, which is the feature that keeps a destructive action behind a human. A governed agent must never hold standing authorization for a consequential or irreversible action without a human in front of it. Every script inspects posture and makes no configuration or data changes. Every Graph call is a GET, there is no write cmdlet anywhere in the bundle, and there is no commented-out write command to un-comment. One honest exception, stated here rather than left for you to find: the first admin consent to the Microsoft Graph PowerShell client registers that client's service principal and your delegated read-scope grant in Entra. Both are created by your consent rather than by a script, both are created once for the tenant rather than once per run, and both are reviewable and revocable under Enterprise applications. The only file any of them writes is a local findings CSV on your own machine, and only when you pass -CsvPath. See it before you buy Gumroad has no file-preview mechanism, so rather than ask you to take the read-only claim on trust, three of the files below are in the FREE Lite bundle instead. It is a $0 download on this same store, so you can read them, and run the sample script in your own tenant, before you spend anything here: the FREE sample script sample-list-agent-identities-v1.ps1, which lists your Entra Agent IDs and flags any with no named, active sponsor; the per-script sample outputs, showing what each script prints across the four assessment scripts plus the free sample. These are constructed illustrations rather than captures of a live tenant, on the fictional Northwind Grid Services tenant with no real data, and the verdicts, flag wording and column layout are reproduced exactly as the scripts emit them; the required-reader-roles matrix, which names the exact least-privileged READ scope each script needs, so you can verify the bundle asks for read rights only. Get the free bundle first if that matters to you. It is on this same store, free, listed as Agent Security Verification Checklist for Microsoft 365 Copilot (Lite). The August tenant run Named here with its limit in the same breath, because it is the only real measurement in this product. The author ran every PowerShell script in this bundle, the three PowerShell assessment scripts plus the free sample, end to end against a purpose-built Microsoft 365 E5 tenant, with seeded canaries and with ground truth recorded out of band, from a separate administrator session, before each run. One tenant, one operator, and that operator is the author, 15 to 18 August 2026. That run found defects in the kit's own scripts and those defects were fixed before this went on sale, which is the whole of the claim: a process claim about how the kit was built, never an assurance claim about your agents, and nobody outside has looked at any of it. Three limits travel with the name. The fourth assessment script, the KQL query pack, was evaluated against records captured from that tenant rather than executed in Log Analytics, so "this query cannot return a row against this record shape" is established and "this query returned zero" is not. The sample outputs shown above stay constructed illustrations rather than captures, and no amount of tenant work changes that. And the two dates do not merge: documentary claims are current as of July 2026, only the tenant measurements are 15 to 18 August 2026. The item-by-item bound list, including everything the run never touched, is in "What this kit does not prove", which the free tier also ships so you can read it before paying anything. What's inside The Verification Kit, full T1 to T8, as a typeset PDF and its Markdown source. Eight per-control test cards, numbered T1 to T8 consistently across the kit, the scripts, and this listing: T1 prompt injection and the ContentFiltered probe, T2 distinct agent identity with a named accountable sponsor, T3 least privilege and permission inheritance (end-user not maker credentials, no unneeded write or delete scopes), T4 the destructive-action human approval gate, T5 DLP for Copilot, T6 oversharing, T7 audit attribution, and T8 grounding. Each card carries what-to-test, steps sourced to Microsoft Learn, then PASS/FAIL/Fix and a standards anchor, plus an audit header and result tables you fill once per run. The threat-to-standards crosswalk rides inside as a static reference table. The mailbox-wipe board one-pager, as a typeset PDF and its Markdown source: the precise answer to "what stops an agent wiping a mailbox," the five load-bearing controls in the order they apply, and the explicit note that the content filter and the runtime confirmation prompt are courtesies, not controls. Agent-inventory assessment script assess-agent-inventory-v1.ps1: read-only Microsoft Graph PowerShell that enumerates agent identities with their owners and sponsors and flags any with no named, active human sponsor or owner (test T2). It spans Entra Agent IDs and legacy app registrations on a best-effort basis and states its blind spots up front: Agent Builder agents carry no Agent ID, draft and unpublished agents have no directory object at all because publishing is what mints the Agent ID, and legacy app registrations cannot always be reliably classified as agents. It calls the v1.0 Graph endpoints, not the beta ones. Treat the count as best-effort, not a guaranteed complete census. Least-privilege assessment script assess-least-privilege-v1.ps1: read-only Graph PowerShell that lists app-only agents holding write, delete, send, or manage application scopes beyond a read-only need, such as Mail.ReadWrite (test T3 and the mailbox-wipe dangerous path). It reports the over-privileged set and makes no configuration or data changes. Audit-signal query pack assess-audit-signals-v1.kql: read-only KQL in two source-separated sections. Section A queries Application Insights for the content-filter error (OnErrorLog with ErrorCode = ContentFiltered). Section B queries an ingested Purview audit table (Log Analytics or Sentinel) and is written against a measured record shape rather than a documented field list: it censuses what your tenant actually emits under AccessedResources, keys jailbreak detection on Type = JailBreak (matched case-insensitively), and reports attribution completeness on AgentId, AgentBlueprintId, AppIdentity, and AppHost (tests T1 and T7). Its header carries the accuracy caveat, and it is specific: a live capture on 17 August 2026 found the documented XPIADetected and JailbreakDetected flags, the Messages property, and AgentName absent from every record, so queries built on them returned a false clean rather than an error. Confirm your own ingestion's table and column names before you trust a result, and read a missing field as inconclusive, never as an automatic PASS. DLP-for-Copilot presence check assess-dlp-copilot-policy-v1.ps1: read-only PowerShell that checks for a "Microsoft 365 Copilot and Copilot Chat" Purview DLP location and reports its presence and mode (enforcing versus still in simulation) as an indicator, not a proof of protection (test T5). Presence and mode alone do not establish efficacy: scope, groups, conditions, exclusions, and licensing all matter, so treat a present policy as a signal to investigate, not a PASS. The FREE sample script sample-list-agent-identities-v1.ps1, included here too: the concept-prover that lists Entra Agent IDs and flags any with no named, active sponsor. The run guide assessment-scripts-readme-v1.md, as a typeset PDF and its Markdown source: how to run each script read-only, the required modules, the reader roles to use, the expected output, the explicit read-only safety statement, and the non-determinism "run each behavioral probe several times" rule. The required-reader-roles matrix required-reader-roles.md, as a typeset PDF and its Markdown source: the exact least-privileged READ scope each script needs and the read calls it makes, so you can confirm before you run that nothing asks for a write role. Per-script sample outputs sample-outputs.md, as a typeset PDF and its Markdown source: one worked example per script, so you know what a finding looks like before you point it at a live tenant. Constructed illustrations rather than captures of a live tenant, with the verdicts, flag wording and column layout reproduced exactly as the scripts emit them. A checksum manifest MANIFEST.sha256: SHA-256 checksums for every file in the script bundle, so you can verify the files you received match the checksums that shipped. This is an integrity check, not an authenticity signature: it catches accidental corruption or truncation, but does not by itself prove origin (a tamperer could regenerate it), so treat it as a checksum, not a signature. What this kit does not prove what-this-kit-does-not-prove-v1.md, as a typeset PDF and its Markdown source: the limits page, and the one to read before you cite a passed check as evidence to anyone. It names every boundary a full green sheet does not establish: it does not prove your other agents are safe, does not confer prompt-injection immunity, does not extend Conditional Access over non-Entra tools, does not certify your licensing entitlement, and does not replace Microsoft's own documentation. It also states the bounds of the author's live-tenant testing, item by item, including what was measured, what was not tested, and what returned an empty result rather than a pass. The licensing dependency matrix licensing-dependency-matrix-v1.md, as a typeset PDF and its Markdown source: which agent-security capability depends on which licence, what the prerequisite chain is, and the three-question entitlement check to date and file before an audit. This is the file the limits page tells you to use when it says a capability you are not entitled to is absent until you confirm otherwise, so it ships here rather than being left as advice. The risk acceptance form risk-acceptance-form-v1.md, as a typeset PDF you can print and sign and its Markdown source you can paste into your own register: the one-page form plus a register, for the case the verification kit sends you to twice. A check you cannot run, a capability you are not licensed for, or an N/A on a non-critical control is a documented acceptance a named human signs with an expiry and a re-test trigger, never a checkbox. The form makes that cheap enough to actually do. Price and ladder rationale $69. The free Agent Security Verification Checklist (Lite) plus its one sample script is the front door that feeds this. This Core tier feeds the $97 Team tier, which adds the 30-page, 10,000-word source-cited dossier, the filterable crosswalk workbook, sample audit-log artifacts, a citation workbook, and an internal-use org license that covers a whole organization with no headcount limit. Freshness and updates Two dates here, because there are two kinds of evidence. Documentary claims are current as of July 2026, each one traced to a page you can open yourself. The live-tenant measurements were taken against a purpose-built Microsoft 365 E5 tenant from 15 to 18 August 2026, one tenant and one operator, and that operator is the author. Every one of the four PowerShell scripts in this kit was changed by what that run found, and the checks it could not exercise are listed in "What this kit does not prove". Re-verification is semi-annual and the next re-verify is due February 2027. Buyers get updates to the current edition free. Agent-security surfaces move fast, so re-verify each cited page against its primary source before each audit cycle. FAQ Q1: What exactly do I get, and do I have to read a book to use it? No. The buyable unit is the audit instrument, not a report you plow through. Twenty-two files: the T1 to T8 verification kit, the mailbox-wipe board one-pager, four read-only assessment scripts plus the free sample script, a run guide, the required-reader-roles matrix, the per-script sample outputs, a checksum manifest, the limits page, the licensing dependency matrix, and the risk acceptance form. Every document ships as both a typeset PDF and its Markdown source, so you can print and circulate it or paste it into your own audit materials; the scripts ship as scripts. You can run the kit and the scripts without reading a single page of prose. Q2: Will these scripts run in my setup, and what access do they need? They are PowerShell for Microsoft Graph and Exchange, plus KQL for Application Insights and Log Analytics, the native tenant-assessment languages. Every one runs read-only, and the required-reader-roles matrix, which you can read for free in the Lite bundle before you buy anything here, tells you which of two shapes of answer applies to each check. For two checks the answer is a role: the DLP check uses View-Only DLP Compliance Management (which ships inside Security Reader), and the KQL needs Reader on the Application Insights resource and the Log Analytics or Sentinel workspace. For the three Graph scripts the answer is not a role at all. They need the delegated read scopes AgentIdentity.Read.All, Directory.Read.All, and Application.Read.All, and because all three are admin-consent scopes, a one-time tenant-wide admin consent is the real gate. It fires before a token is issued, so no reader role substitutes for it, and a tested run confirmed an operator holding zero directory roles succeeds once consent is in place. Arrange that consent before your first run; it is the step that most often stops one. Nothing needs a *.ReadWrite scope or an admin write role. The KQL carries its own caveat: confirm your own ingestion's table and column names, and note that a live capture on 17 August 2026 found several documented audit flag fields absent from the emitted records, which is why Section B keys on the element type that was measured to work rather than on those flags. A missing field is inconclusive, not a PASS. Q3: How long does it take? You can run the full kit against one agent in an afternoon. The four assessment scripts plus the free sample each run in minutes and hand you a finding you decide on. Because LLM output is non-deterministic, the behavioral probes (prompt injection and the human gate) must be run several times, and one follow-through out of five is a FAIL, not a fluke. Q4: Is this just AI-generated fluff? The prose was drafted with AI agents inside a gated factory pipeline, and it is more honest to tell you than to pretend otherwise. It then passed a deterministic slop scanner and a build checker, and it was fact-checked against authoritative sources, cross-checked by multiple web-capable models plus a vendor-diverse model council to catch fabrication, with load-bearing security claims held to the highest bar. Every citation traces to a named authoritative source (Microsoft Learn, MSRC, NVD, OWASP, MITRE, or NIST); the EchoLeak CVE is cited to its NVD record, with the 9.3 Critical score attributed to Microsoft as the CNA and NVD's own 7.5 base score named alongside it, and the threat-to-standards mappings are interpretive crosswalks, not primary facts. The scripts were verified read-only against the Microsoft API documentation (Graph, Purview, Entra). The limits of all of it are written down in the kit's own "What this kit does not prove" page, including what the live-tenant test did not cover. Q5: What about refunds and licensing? One purchase covers your own use inside your organization: run the kit and the read-only scripts against your organization's own tenants, adapt the checklists into your internal audit materials, and share the completed outputs and the board one-pager internally within your own organization (for example, hand the one-pager to your risk committee, which is exactly what it is built for). What you may not do is redistribute or resell the source files outside your organization. Full terms are at kesslernity.com/license. It is a Gumroad purchase, so refunds go through Gumroad. The refund expectation is stated at the top: if you wanted a destructive or attacking script, this product does not ship one by design, so please self-select out before buying. Who it's not for This is not for someone who wants software: there is no dashboard here, no connector, no automated pipeline. The scripts are read-only assessment tools, not remediation runbooks. It is not for non-Microsoft agent stacks; it is M365 Copilot specific. It is not legal, compliance, or regulatory sign-off. It is not a live assessment of your tenant; that is a separate engagement not sold here. And it is emphatically not for anyone hunting a script that performs, simulates, or enables a destructive or attacking action, because refusing to ship one is the entire point. Disclaimer This product is an orientation and verification-methodology aid. It is not security, legal, compliance, or regulatory advice. It is not a guarantee of any security outcome. The read-only assessment scripts are run at the buyer's own discretion under least-privileged reader roles. Microsoft changes product behavior and control defaults over time, and standards versions move too; claims are stamped as of July 2026, so re-verify each cited primary source before relying on it. Nothing here authorizes an AI agent to hold standing authorization for a consequential or irreversible action; a human decision must sit before any such action.