Agentic Capabilities
Halo runs five AI agents in production. Each has one bounded job, reads only what that job requires, and can never write to your programme's approved, governed state — no agent promotion, no silent write, ever. What follows is the same governance model we hold customers to, applied to ourselves first.
This page describes what each agent does today, in production. We'll update it as agents change — not describe capability we haven't shipped.
As with the rest of the platform: Halo tracks and supports a customer's path to certification. It does not itself certify or assert compliance status.
Evidence Pipeline Agent
Ingests uploaded evidence — documents, images, structured exports — and harmonises it into a consistent internal representation, with a quality review pass before it becomes usable for assessment.
Writes: Staged evidence only.
Assessment Brain
Drafts proposed control status updates and generates pre-audit challenge questions — preparation material to help a practitioner anticipate how an auditor might probe a control, before a real review happens.
Writes: Staged proposals only.
Reporting Agent
Generates narrative summaries from data already produced elsewhere in the platform — status reports, drafts for review.
Writes: Nothing. Read-only by design.
Feedback Agent
Passively observes patterns in how humans override or verify other agents’ proposals, surfacing reflective themes over time. Never involved in a live assessment decision.
Writes: A separate reflective feedback record only — never scoring, workflow, or approved content.
AI Assistant Agent
Answers questions about your control programme in plain language, and — when asked to take an action — proposes it: which control, what change. It never decides on your behalf.
Writes: Nothing directly. Every proposed action requires an explicit human confirmation before anything runs, and the exact control or framework named is independently checked against your real workspace data — never taken on the model’s word.
The rule underneath all five
No agent may write directly to approved state, under any circumstance. Every output lands as a proposal — staged, not promoted — and requires an explicit, auditable human decision before it becomes part of your programme's record. This isn't a policy we apply after the fact; it's enforced in the code path itself, independent of what any agent's output claims.
We hold this to the same scrutiny we'd expect a customer to apply to their own controls. Where an agent has an actionable output — proposing a specific control or framework action, as the AI Assistant Agent does — we've verified, through dedicated adversarial testing, that its server-side enforcement boundary holds even when the model's own output is assumed fully compromised — because the control that actually matters isn't the model's good behaviour, it's the server-side check that never trusts the model's word for anything that leads to a write.