gordonguard

Adversarial testing guardrails

Enterprise evidence

Insufficient enterprise evidence

Public information covers sso & provisioning, access controls, auditability. Still unresolved: security assurance, reliability & support, product effectiveness.

8 official sources · Fresh page review · Not independently tested

Sources reviewed 2026-11-07

4 / 7 areas with published evidence · 0 independently verified

Evidence & checks

Security assuranceNeeds clarification

### **ISO 27001 Compliance**Reviewed 2026-11-07View source

- SOC 2 audit trail requirementsReviewed 2026-11-07View source

Before relying on it
Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.

SSO & provisioningCompany-published

- Single Sign-On (SSO) with KeycloakReviewed 2026-11-07View source

| `client.sso` | Single Sign-On connections and authorization |Reviewed 2026-11-07View source

Before relying on it
Test SSO enforcement, user removal and privileged-account recovery.

Access controlsCompany-published

- Role-based access control (RBAC)Reviewed 2026-11-07View source

- Fine-grained permissionsReviewed 2026-11-07View source

Before relying on it
Test least-privilege roles and cross-tenant access with separate test accounts.

AuditabilityCompany-published

- Comprehensive audit trails for all user actions and HTTP requestsReviewed 2026-11-07View source

- SOC 2 audit trail requirementsReviewed 2026-11-07View source

Before relying on it
Verify administrative and data-access events, retention and export.

Data handlingCompany-published

question plus rows for region, operator, contact and subprocessors.Reviewed 2026-11-07View source

Before relying on it
Review DPA, subprocessors, retention, deletion, residency and AI training use.

Reliability & supportNot found

Before relying on it
Request SLA, incident history, recovery targets and support escalation terms.

Product effectivenessNot found

Before relying on it
Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.

Published claims are not verified controls. No hands-on performance or security testing has been performed.

What we know

Provides adversarial testing and runtime guarding specifically for agents that spend money, including probes for settlement and behavioral attacks.

Worth asking

Can the runtime guardrails be decoupled from the adversarial test suite for use in production environments?

Sources

Evidence details

Enterprise controls

- Centralized logging with correlation IDs - Automatic HTTP request/response audit logging (ISO 27001 compliant) - Debug logging with detailed request/response information (when `log_level='debug'`) - Performance tracking and metrics - Error tracking and debugging - Health monitoring - Automatic data masking for sensitive information in logs - Configurable sensitive fields via JSON configuration All HTTP requests are automatically audited with ISO 27001 compliant data masking Output: ``` glba: NON_COMPLIANT risk=0.61 pci_dss: NOT_APPLICABLE risk=0.00 soc2: COMPLIANT risk=0.12 ```

Developer access

- JWT token validation - API key authentication - Token revocation support - Secure token storage - Data encryption/decryption (AES-256-GCM) It provides **100% coverage of the OneTrust public API** — every operation across all **35 OpenAPI specifications** (~600 operations, 7 product areas) is exposed as both a typed client method and an action-routed MCP tool ### Run A2A Server ```bash export ONETRUST_URL="https://acme.my.onetrust.com" export ONETRUST_TOKEN="your_token" onetrust-agent --provider openai --model-id gpt-4o --api-key sk-..

Last checked Nov 7, 2026

Company-published evidence, not an independent audit. Unknown means unverified.