Three products, one question: what was the agent allowed to do?

The portfolio looks like three products. Operationally it is one question asked at three moments.

1. Before exposure: MCP Security Pass — $500

A server is about to be published. The question is: what can an agent do with it, and what happens when it tries something outside the intended scope?

The pass is a 10-check review: auth, authorization, least privilege, tool descriptions, input validation, secrets, denial logging, replay, transport, supply chain. Output: findings, severity, evidence, fix order.

2. During operation: Deny Evidence — $29/month

The server is live. The question changes: what did the agent try, and what was refused?

A log of allowed rows cannot answer that. A signed refusal record can: policy, reason, task, artifact hash, timestamp. Verifiable offline, without custody.

3. For the buyer: EU AI Act Evidence Pack — $1,500

The product is being sold into the EU. The question becomes: where is the evidence package?

The pack maps the system to record-keeping, human oversight and technical documentation, and includes the deny log as evidence. Five days; express 72 hours for $3,000. Evidence, not a legal opinion or a certification.

Why they are separate

A security review does not need a monthly subscription. A refusal log does not need a consulting engagement. An EU pack does not need a custom audit of every server. Sell the smallest artifact that answers the buyer's actual question.

The shared principle: do not claim safety; produce a record that can be checked.

The portfolio

• Deny Evidence — signed refusal log, $29/month: https://attest.rta.lat/deny-evidence
• MCP Security Pass — $500 review before you expose a server: https://rta.lat/audit/
• EU AI Act Evidence Pack — $1,500 / 5 days; $3,000 / 72 hours: https://attest.rta.lat/eu-ai-act-evidence