Someone in your org has spun up a Copilot agent, and you have been asked whether it is safe to keep running. You want a defensible yes-or-no per control, not a vendor screenshot. This is the front-door version of the full verification kit: a seven-check printable audit sheet plus one read-only script you can point at your own tenant today. Run it against one agent in an afternoon. Each check names what to test, the steps sourced to a named Microsoft or standards page, and what a PASS versus a FAIL looks like. Check 1 is the ContentFiltered prompt-injection probe, the one most teams over-trust, with the honest caveat that the filter is probabilistic and EchoLeak (CVE-2025-32711) proved classifier layers alone were bypassed. The sheet enforces one governance position throughout: AI prepares, humans decide, which is the feature that keeps a destructive action behind a human. An unrun check is a FAIL until proven otherwise. The bundled sample script is read-only by design: it makes no configuration or data changes. We do not ship attack or destructive-test scripts, because that boundary is the whole point. The read-only claim covers the script; the checklist's behavioral checks (the prompt-injection probe and the destructive-action gate test) are active tests that send live prompts and can trigger agent actions, so run them against a non-production or explicitly consented agent, never blind against production. This is not a guarantee of any security outcome; it is a verification aid. Everything is stamped and traces to an authoritative source: the documentary claims as of July 2026, and the live-tenant measurements in the limits page as of 15 to 18 August 2026. The August tenant run Named here with its limit in the same breath, because it is the only real measurement behind this bundle. The author ran the read-only sample script in this bundle end to end against a purpose-built Microsoft 365 E5 tenant, with ground truth recorded out of band, from a separate administrator session, before each run. One tenant, one operator, and that operator is the author, 15 to 18 August 2026. That run found defects in the script and they were fixed before release, which is the whole of the claim: a process claim about how this was built, never an assurance claim about your agents, and nobody outside has looked at any of it. The Lite checklist itself was not the subject of those measurements, the two dates do not merge (documentary claims July 2026, tenant measurements 15 to 18 August 2026), and the item-by-item bound list is in "What this kit does not prove", which ships free in this bundle. What's inside The Lite Verification Checklist as a typeset PDF and its Markdown source: seven headline checks, each with PASS, FAIL, N/A columns and a date field, plus an audit header you fill once per run. The seven checks are a deliberate subset drawn from the full T1 to T8 controls: the ContentFiltered prompt-injection probe (T1), distinct identity with a named accountable sponsor (T2), end-user versus maker credentials and no unneeded write or delete scopes (T3, shown as two checks), the destructive-action human gate (T4), DLP for Copilot (T5), plus audit attribution (T7). It does not include oversharing (T6) or grounding (T8); those are in the full kit. The printable audit sheet as a typeset PDF and its Markdown source: the same seven checks stripped to a one-agent, one-auditor, one-afternoon worksheet with a fill-once header and PASS / FAIL / N/A rows, so you can put it on a clipboard and record against it instead of reading prose. One read-only sample assessment script sample-list-agent-identities-v1.ps1: Microsoft Graph PowerShell that enumerates your Entra Agent IDs and flags any with no named, active sponsor, matching Check 2 of the sheet. It inspects posture and makes no configuration or data changes, so you can prove the concept in your own tenant before deciding on the full kit. What access each check needs, before you start required-reader-roles.md, as a typeset PDF and its Markdown source: the per-script matrix of directory roles and Graph read scopes, the one-time admin consent that stops most first runs, and the one place Microsoft's own documentation contradicts itself. It is in the free bundle so you can settle the access question inside your own org before you spend anything. What every script prints sample-outputs.md, as a typeset PDF and its Markdown source: per-script sample output for all five assessment scripts, including the four that only ship in the paid bundles, so you can see the shape of a finding before you decide whether it is worth paying for. These are constructed illustrations rather than captures of a live tenant, and they are labelled as such. Why these seven checks why-these-seven-checks-v1.md, as a typeset PDF and its Markdown source: the design rationale behind the subset, and the residual risk each check leaves standing even when it passes. Read it if you have to defend the choice of checks to someone who did not pick them. What the full kit adds whats-in-the-full-kit-v1.md, as a typeset PDF and its Markdown source: a plain list of what Core and Team contain, so the upgrade decision is a comparison rather than a guess. What this kit does not prove what-this-kit-does-not-prove-v1.md, as a typeset PDF and its Markdown source: the limits page. Every boundary a full green sheet does not establish, including prompt-injection immunity, licensing entitlement, and the bounds of the author's own live-tenant testing. It ships in the free bundle on purpose: if the honest limits change your mind, that is the right outcome before you pay anything. Price and ladder rationale Free. Pay what you want, including $0, in exchange for an email. This is the front door. It feeds the $69 Core verification kit (all eight controls plus four read-only assessment scripts, this free sample, and a checksum manifest), which in turn feeds the $97 Team tier (the 30-page source-cited dossier, the filterable crosswalk, and an internal-use org license with no headcount limit). Freshness and updates Current as of July 2026. The Lite checklist carries its own cadence in its footer, quarterly, with the next review due October 2026, and that is the one that governs this file. You get updates to the current edition free. Re-verify each cited page against its primary source before acting. FAQ Q1: What exactly do I get? Fifteen files. The seven-check Lite checklist and the printable audit sheet, one read-only PowerShell sample script, and five short reference documents: why these seven checks, what the full kit adds, what this kit does not prove, the required-reader-roles matrix, and the per-script sample outputs. Every document ships as both a typeset PDF and its Markdown source, so you can print it or edit it. No login, no drip course, no video. Q2: Will the script run in my setup, and what access does it need? It is Microsoft Graph PowerShell and runs delegated (interactive sign-in) using the Graph read scopes AgentIdentity.Read.All and Directory.Read.All. Both require a one-time admin consent in your tenant, and that is the part to arrange first: it is what stops most first runs, and no tenant setting substitutes for it. Beyond consent, a plain member account needs no directory role, though a guest account cannot read agent identities at all. The scopes are read-only, and the script never requests a *.ReadWrite scope or an admin write role. Whoever grants the consent needs a role that can, which a reader role cannot; the required-reader-roles matrix, which ships in this free bundle rather than behind the paywall, spells out both gates and the one place Microsoft's own documentation contradicts itself. It lists agent identities and their sponsors and flags the ones missing an accountable human. Q3: How long does it take? An afternoon for one agent. Because LLM output is non-deterministic, run the behavioral probes several times; one follow-through out of five is a FAIL, not a fluke. Q4: Is this just AI-generated fluff? The prose was drafted with AI agents inside a gated factory pipeline, then passed a deterministic slop scanner and a build checker, and was fact-checked against authoritative sources. Every citation traces to a named authoritative source (Microsoft Learn, MSRC, NVD, OWASP, MITRE, or NIST); the EchoLeak CVE is cited to its NVD record, with the 9.3 Critical score attributed to Microsoft as the CNA and NVD's own 7.5 base score named alongside it, and the threat-to-standards mappings are interpretive crosswalks, not primary facts. The sample script was verified read-only against the Microsoft Graph docs. Q5: What is the catch on a free product? The catch is your email and an honest upsell. This Lite sheet is a deliberate subset of the full kit, built new for this tier rather than a teaser paragraph. If it proves useful, the Core kit covers all eight controls with four more read-only scripts. Who it's not for This will not give you the full audit instrument: it is seven checks, not the eight-control T1 to T8 kit, and it ships one script, not the four assessment scripts plus this sample that come with Core. It is M365 Copilot specific, not for other agent stacks. And it is not security advice or a guarantee; it is a verification aid. Disclaimer This product is an orientation and verification-methodology aid. It is not security, legal, compliance, or regulatory advice. It is not a guarantee of any security outcome. The read-only sample script is run at the buyer's own discretion under a least-privileged reader role. Claims are stamped as of July 2026; re-verify each cited primary source before relying on it. Nothing here authorizes an AI agent to hold standing authorization for a consequential or irreversible action.