Owned demonstration · technical verification
Three deliberately introduced workflow failures. Observable results. Bounded corrections you can reproduce. This is a synthetic specimen, not a client audit or an evaluation of a language model.
The test application models a workflow creating a business record. We inspect whether authority exists, whether retries duplicate work and whether a failed write is represented truthfully. Both the deliberately flawed version and the corrected version run against the same criteria.
3
Defects reproduced
3
Corrected cases passed
1
Approved-action positive control
Counts describe this small, sequential in-memory specimen. They are not a production reliability rate.
Finding 01 · High within this demonstration
An action could proceed without the required human authority.
recorded; 1 records
blocked; 0 records
Correction: Check trusted approval at the action boundary.
Finding 02 · High within this demonstration
Retrying the same intent could duplicate a business record.
2 records; 2 writes; same result: false
1 records; 1 writes; same result: true
Correction: Use a stable operation key and return the prior result.
Finding 03 · High within this demonstration
The user could rely on work that was never persisted.
recorded; 0 records
unconfirmed; 0 records
Correction: Represent the failed write as unconfirmed instead of claiming success.
Sequential in-memory approval, duplicate-request and failed-write cases; no LLM evaluation, distributed concurrency, real authentication, external API or production environment. The simple operation-key map demonstrates sequential deduplication; a real service also needs durable storage, atomic writes, concurrency tests and recovery for uncertain external outcomes.
Severity reflects the possible business consequence in this constructed workflow. A real review determines severity from the actual authority, data, users and operational exposure. Reviewing our own specimen is technical verification, not an independent assessment of our work.
Save the source in an empty folder and run node ai-controls-specimen.mjs with Node.js. It writes source and results to public/proof/ in that folder and makes no network calls. Its output includes a source checksum.
A scoped engagement adds your requirements, representative scenarios, system version, evidence, coverage gaps and a prioritised remediation plan. Access and price are agreed before testing.
Discuss a system reviewReview scope and deliverables