01
Attack, not checklist
It turns one pipeline into boundary cases: destructive verbs, endpoint confusion, token theft, cost bursts, PII egress and signer wildcard abuse.
Latch × Rialo Permission assurance for autonomous agents
Break your agent policy before an agent does.
Paste a Latch pipeline. LatchLens generates adversarial requests, exposes hidden permission gaps, shows the exact filter trace and prepares a tamper-evident proof for Rialo.
No API key required
Deterministic test engine
Exportable evidence
live attack trace
case 07 / identity
AGENT
POST
/v1/transfer
01
method
POST allowed
pass
02
endpoint
route matched
pass
03
identity
missing signed slip
deny
OUTCOME
credential untouched
403
Interactive prototype
Policy attack lab
Local-first
Optional live comparison uses Latch Authorize
01
Input
Latch policy JSON
ready
02
draft proof
Assurance report
Attack surface
0
/100
Exposed
Support agent — draft
Policy needs containment
Run the suite to see where authority escapes its intended boundary.
0
protected
0
exposed
0
critical
Local proof receipt
Ready to generate- Policy hash
- —
- Report hash
- —
- Generated
- —
- Program ID
- not deployed
- Transaction
- not submitted
Rialo attestation payload
Prepared locally. No transaction is submitted.Optional onchain proof
Anchor on Rialo DevNet
Download the deterministic request, submit it with your own DevNet wallet, then paste only the public transaction signature. LatchLens never asks for a seed phrase or private key.
The missing layer
Enforcement is only half the job.
Latch enforces a policy. LatchLens asks the uncomfortable question: does the policy actually express what its owner meant?
02
Explain every denial
Every scenario includes the ordered first-deny trace, so builders can distinguish real protection from accidental breakage.
03
Proof, not screenshots
Reports are deterministically hashed and shaped for a Rialo attestation, turning a one-time test into portable evidence.
Rialo-native roadmap
Continuous assurance, without another keeper.
Local analysis never needs a credential. Optional Live Latch Verify sends six safe hypothetical requests through a narrow Vercel adapter to Latch Authorize, then compares canonical decisions with the local mirror. A Rialo workflow can later detect drift and anchor only the report hash—not the private policy.
01
INPUT
Latch policy
Scoped rules stay private.
02
TEST
LatchLens deck
Boundaries are attacked.
03
VERIFY
Latch Authorize
Canonical traces confirm.
04
PROVE
Rialo receipt
Hash and score are anchored.
MVP boundary
Local results remain drafts until explicitly checked. Live verification is opt-in, labels skipped context-only cases, and never claims a Rialo anchor; the DevNet attestor still requires deployment.
Built for builders