Case Study · Design Partner: Optimo AI · Proof of Concept closed July 2026
An autonomous vendor risk analyst, governed and ungoverned, side by side.
CISO Perspective: The risk is not that the agent gets breached. It is that a properly authenticated agent does exactly what it was built to do, at machine speed, and arrives at an outcome nobody authorized.
The Problem
Optimo AI builds autonomous agents for clients and runs a vCISO practice. Like every builder in this market, they kept hitting the same wall. When a client asked for an agent that could act on its own, the honest answer was some version of do not let it run autonomously, it is too open.
What We Tested
At a Glance
- The agent. An autonomous AI vendor risk analyst. It receives a vendor request, pulls trust center documents, extracts security controls, assigns risk ratings against policy, creates remediation tickets, updates the GRC platform, and issues approval and rejection recommendations.
- The setup. Two mirrored environments running the same agent. One ungoverned. One with Mountain Theory deployed alongside the agent, evaluating every intended action before it executes.
- The scope. 12 test cases covering vendor review, GRC procedure, prompt injection, and unauthorized deletion of audit evidence.
- The policy. Authored in plain English. Three outcomes at every checkpoint. ALLOW, HOLD for human approval, BLOCK.
Results
Measured against the four criteria set in the proof of concept scope document.
Autonomous run. 12 test cases were built for the engagement. The vendor risk analyst completed vendor reviews end to end without a human driving each step.
Control proven. Enforcement was automatic. In the words of Optimo’s founder:
The ungoverned environment deleted evidence files when asked. The same agent under Mountain Theory was blocked, and blocked again several times when it tried to reach the same result by chaining tools. High-risk actions routed to a human for approval before anything executed.
Peter Holcomb, Founder and CEO, Optimo AI
Visible toggle. Both environments ran side by side. The difference between governed and ungoverned was observable in real time, not reconstructed from logs after the fact.
Audit trail. Every allowed, held, and blocked action was logged with the policy that matched it.
The Finding That Matters
The first block is the one everyone expects. The agent was told not to delete audit evidence. It tried. It was stopped.
The second block is the one worth attention. The control was written correctly and the agent accepted it, then went looking for another way to reach the same outcome, chaining tools together to route around the rule it had just been given. It tried several times. Every attempt in the demonstrated runs was stopped at the action, and repeated attempts are bounded by an adjustable attempt cap.
That is the failure mode almost nobody is testing for. It is not a prompt problem and it is not an identity problem. The agent was properly authenticated the entire time. It simply found another path.
You cannot catch that by inspecting the request. You catch it by sitting at the action.
Why It Matters
Identity solves attribution. Control solves outcomes. The gap lives at execution.
Every significant autonomous AI failure on record happened with properly authenticated AI. None of these were breaches of identity. Execution was the gap. The CSA CISO community reached the same conclusion in its post-mortem of the Hugging Face incident, which we mapped ourselves in The CISO Agenda After Hugging Face.
What It Unlocks
A builder like Optimo no longer has to hold clients back. The answer to can this agent run on its own changes from not safely to yes, and here is the control that proves it. Vendor risk was the proving ground, not the product. The same pattern holds for any agent in any vertical. You build an agent to do A through C. The moment it tries to do D, it is stopped, held, or flagged.
Pattern
A correct control is not a sufficient control. An agent that accepts a rule will look for a path the rule does not cover. The control has to sit where the action fires, not where the request is written.
Optimo AI participated as a design partner, not as a paying customer, and Mountain Theory is not deployed in an Optimo production environment. Peter Holcomb also serves as an advisor to Mountain Theory. Results reflect a controlled proof of concept environment completed July 2026. Quotation used with permission.
Want the Same Test Run Against Your Agents?
30 minutes. No slides. We walk you through where the action fires and where the circuit breaker would sit.