1. We agree on goals before we start
With your Security and Technology committee we set what we will measure and when the decision is made. For example:
| What changes | Example goal |
|---|---|
| Time to approve an agent use case | From months to weeks |
| Credentials within the agent’s reach | Zero |
| AI used outside what’s approved | Lower than before the pilot |
| Blocks that end in a completed task | Most of them |
| Developers using it every week | Most of the team |
2. We define the policy and environment together
What the agent can see, do and where it can send data in that project; who approves exceptions; where Harkaq runs and which data is used.
3. The team works with the agent
Developers use their usual agent, Claude Code or Codex, inside Harkaq. Security sees everything in the console and approves what’s needed. We support the team and adjust the policy with what we learn.
4. We decide on results
At the end we deliver the evidence report for auditors and regulators and review the goals with your committee. If they were met, we expand to more teams. If not, you know exactly why.
We prove it in front of your team
Harkaq’s barriers are tested in front of your team, with repeatable tests: an agent trying to exfiltrate credentials, an unapproved destination, an injection hidden in an issue. We don’t ask you to trust us; we show you it works.