Agent-ready is a claim.
Akmon makes it a measurement.
Before you hand production systems to AI agents, someone should establish what those systems will actually do when the caller never sleeps, reads your docs literally, and has your credentials. Akmon establishes it — with deterministic gates, sealed evidence, and numbers deflated on purpose.
No model in any gate Sealed holdout corpus Deflated metrics only
Book a benchmarkFixed scope, published price, per repository. $7,500 for the first.
The problem
Agents do not fail
the way users fail.
A user who hits an ambiguous permission stops and asks someone. An agent reads the permission literally and proceeds. Your API surface was designed against the first behaviour and has never once been measured against the second — which is a reasonable thing to have not done, right up until the week you deploy.
The documentation problem is worse than the code problem. Agents do exactly what your docs say, and your docs describe the system as it was intended, not as it currently behaves. Every place those two have drifted apart is a place an agent will confidently do the wrong thing at machine speed, with an audit trail that looks entirely correct.
And readiness decays. It is a property of a specific commit, not of a company. The team that passes a readiness review in March ships four hundred commits by June, and nothing in that process re-asks the question. This is why the durable half of this practice is attestation, not the audit.
What the benchmark replaces
A readiness benchmark is,
in practice, four exercises.
Each of these is something a competent team already knows it should do before an agent rollout. Each is also something that gets scheduled, descoped, and then remembered during the incident review. Akmon runs all four as one fixed-scope engagement and leaves behind evidence rather than a slide.
A red-team week
Someone senior, blocked out for five days, trying to make the system misbehave under agent-shaped pressure — and writing it up.
Usually descopedA permissions audit
Every scope, token, and role re-read against what an untiring caller could actually reach with it.
Usually staleAn API-contract review
Docs read line by line against real behaviour, since the agent will believe the docs.
Usually never doneThe postmortem
The one you would otherwise write afterwards, with the findings you would otherwise learn expensively.
Usually the triggerWhat gets measured
Five surfaces, scored against evidence.
Every score below is produced by a gate script: pure code, fail-closed, exit 2 on ambiguity. No model decides whether your system passed. A model that scores its own kind is not a measurement, and we will not sell you one.
Your permissions are read literally.
Every scope an agent could hold is expanded to what it can actually reach — not what the role was named for. Scope is measured by reachability, not by intent, because the agent has no theory of what you meant. Over-broad tokens, transitive reach through service accounts, and privileges that only matter when combined all surface here.
Your documentation is a contract now.
Docs, schemas, and tool descriptions are checked against observed behaviour, because an agent treats them as executable. Drift that a human reader would silently correct for is exactly the drift that produces a confident wrong action at three in the morning.
Your guardrails are tested at machine cadence.
Rate limits, approval gates, idempotency, and rollback paths are exercised the way an untiring caller exercises them. A guardrail that holds against a human and fails at ten calls a second is not a guardrail — it is a speed bump nobody has driven over yet.
Your invariants are pushed on by adversaries.
Domain packs carry evasion corpora — financial invariants, PII boundaries, security hardening — and a portion of every corpus is sealed and never seen during development. That sealed holdout is the only number we publish a catch rate from, which is why the published rates are lower than a demo would show.
Your readiness is re-established on every release.
The benchmark is a measurement of one commit. Attestation re-runs the same gates on your release cadence and produces a customer-shareable artifact plus an alert when a score regresses — which is what makes the claim survivable in an enterprise security review.
“Agent-ready” without an artifact behind it is a sentence in a sales deck. With one, it is something a buyer’s security team can check.
What you receive
Artifacts, not a deck.
The engagement's output is a set of machine-readable files and one written assessment. Every number in the assessment resolves to a file; every file re-generates from a pinned seed.
audit.json
readiness scorecardIllustrative shape, not a customer result. Each score carries the evidence path that produced it.
ledger
hash-chainedakmon ledger verify
chain fin-invariants......... ok
chain pii-boundary.......... ok
chain security-hardening.... ok
seed 679 reproduced ....... ok
# a rewritten history fails here, loudly
catch rates
sealed holdoutReal published numbers, measured against corpora the development process never saw, over the statically-expressible violation classes only. The denominators are small and we print them: a rate quoted to one decimal from seven cases is a rate you should read with the seven in view. We publish the 14.3% for the same reason we publish the 82.4% — a vendor who only shows you their good pack has told you nothing about the pack you need.
attestation
customer-shareableAn attestation states what was measured, when, and under what scope — the form a buyer's security team can actually check, rather than a badge.
mrir
model-release impact reportA new model ships. Your agents change behaviour on a Tuesday, without a deploy on your side. The retainer watches the registry, re-runs your matrix against the new release, and issues a model-release impact report inside five business days.
The anchor subset is what makes a chart across model generations honest; the refresh subset is what keeps the benchmark from testing a codebase you no longer have. Every report states both.
Pricing
Published, not negotiated.
The rate card is the rate card. Scope is per repository, so the price of finding out is the price of one repository — not a discovery phase that bills by the week.
Agent-readiness audit
- Scored readiness baseline across all five surfaces
- Evidence path behind every score
- Gap list, prioritised by the rollout you actually want
- $3,500 for each additional repository
- +$3,000 regulated overlay — financial invariants or PII boundary
Adversarial drift test
- The rotation harness run against your gates
- Evasion-shaped variants of the violations you already pass
- Tells you whether your gates hold or merely match
- Runs with or without a prior audit
Drift watch
- Re-verification every release cycle
- Customer-shareable attestation artifact
- Drift alerts when a score regresses
- Ledger your buyers' security teams can check
- The same engine runs nightly on our own eight-repo fleet
Method, and its limits
The measurement is only worth
what its discipline is worth.
No model sits in the pass/fail path.
Gates are pure code. Ambiguity exits non-zero and fails closed, rather than being resolved by a system with an opinion. This costs coverage — some things a model would flag, a deterministic gate cannot — and we accept that cost, because a score that a model produced is a score that can be argued with rather than checked.
The holdout is sealed, and stays sealed.
A portion of every evasion corpus is never read during development. Catch rates are published from that portion only. This is the single most important reason our numbers look worse than they could: a rate measured against material the authors have seen is a measure of memory, not of detection.
Numbers are deflated on purpose.
Where a metric can be computed generously or conservatively, Akmon computes it conservatively and reports the conservative figure. Reruns are seed-pinned and byte-compared against golden references, so a number that moves has a cause you can name.
What an attestation is not.
It is a technical assessment of named systems at a named commit under a named scope. It is not a certification of regulatory compliance, not a warranty against incident, and not a statement about systems outside the engagement's scope. Anyone selling you the stronger version of that sentence is selling you something else.
Your rollout deserves
evidence.
Tell us what you are deploying and on what stack. We will tell you what the benchmark would cover, and what it would not, before you commit a dollar.
Book a benchmark