Security Review
Ask Tandy to review a voice agent's configuration for risks a caller could exploit, and apply the recommended settings from a single confirmation card.
Tandy can review a voice agent's configuration and report what a caller could abuse, what data the agent exposes, and what to change. It reviews the agent as configured — the prompt, the tools, and the settings you saved — and then offers to apply the fixes that are a settings change.
Running a review
In the Tandy chat, type:
/security-review RileyTyping / on its own opens the list of skills Tandy can run, with a one-line description of
each — pick one with the arrow keys and Enter, or click it. The skill then sits beside your
message as a labeled badge; hover it to see what it does, and press Backspace or click its
✕ to drop it. The badge stays on the message you sent, so a thread makes it plain which
turns were reviews.
Name the agent however you like — its name, its id, or a description of it ("the agent on the support line"). If more than one agent matches, Tandy asks which you meant rather than guessing.
Anything after the agent is extra context, and it changes the review:
/security-review Riley it takes card payments and looks up account balancesTelling Tandy what the agent is for is worth doing. The same tool configuration deserves a different verdict on a store-hours line than on an agent that reaches account data, and Tandy has no way to know which it is looking at.
What it checks
Ten categories:
| Category | What it looks for |
|---|---|
| Credentials in config | API keys or passwords pasted into agent variables, where they're stored as plain text |
| Secret placement | A secret referenced somewhere the platform won't turn it into a credential |
| Tool authority | What a caller can cause by talking — writes, deletions, and account lookups with no check |
| DTMF and recording | Keypad capture of card or identity digits on a call nothing can pause the recording of |
| Memory and carryover | Conversation memory shared between agents, or carried verbatim through a transfer |
| Transfer destinations | Numbers that don't belong to the business, and transfers to agents with wider access |
| Prompt defenses | Whether the prompt separates caller speech from instructions, and verifies before acting |
| Guardrails and steering | PII redaction, and whether steering rules exist for the actions the agent can take |
| Post-call analysis | Extraction prompts that copy sensitive details into reporting |
| Availability and cost | A missing call-length cap, or a silent line nothing hangs up |
Each finding is rated high, medium, or low, and says what a caller or an operator could actually cause — not just which setting is off. Tandy also names the categories that came back clean, so you can tell the difference between "checked and fine" and "not checked."
Tandy never sees the values of your agent
variables. It's told a variable's name, its
length, and whether the value looks like a credential — the check runs before Tandy is involved.
A review can tell you api_key holds something that looks like a key without the key itself
ever reaching the conversation.
Applying the fixes
When a review finds something that's a settings change, Tandy offers one confirmation card listing every fix. Nothing changes until you press Apply, and nothing is applied that isn't on the card.
These are the settings a review can change:
- The system prompt, rewritten to add the missing defenses
- Redact caller PII, and Steering Rules
- Memory scope and what a resumed call restores
- What a transfer to another agent carries over
- How many keypad digits it collects
- The maximum call length, and hanging up on a silent line
A review can only move these toward the safer setting. It cannot use this card to widen memory sharing, turn redaction off, or make a transfer carry more, so an Apply you didn't read closely can't loosen the agent.
The card is all-or-nothing: there's no per-fix checkbox. If you only want some of the fixes, decline the card and make those changes in the agent editor, where each setting sits on its own card. Tandy's report names the card for every finding.
Everything else a review finds is yours to do by hand, and the report says where to go. Tandy won't rotate a credential, change a tool's parameters, remove a tool, narrow an integration's tools, or edit analysis fields — each needs a decision or a credential the confirmation card can't carry.
What a review is not
- It reads configuration, not calls. It doesn't listen to recordings, replay transcripts, or test the agent by talking to it. An agent that behaves badly for a reason not visible in its config will pass.
- It doesn't prove compliance. A clean review is not a PCI, HIPAA, or SOC 2 attestation, and shouldn't be attached to one.
- Some findings are opinions. Whether a prompt adequately separates caller speech from instructions is an opinion, and Tandy says which findings are opinions and which are facts about your config. Read the high-severity ones yourself before acting.
- It reviews one agent at a time. If an agent transfers to another, review that one too — the report will tell you when the target has wider access.
Troubleshooting
Tandy says it can't run a security review. The review needs to read your agents, and that read wasn't available for this conversation. Start a new chat and try again.
It asks which agent I meant. Two or more agents matched what you typed. Answer with the name or paste the agent's id.
A fix was refused when I pressed Apply. Most likely Redact caller PII on an agent whose model isn't hosted on Bedrock — redaction is delivered by a Bedrock guardrail, so it can't be applied to a model running elsewhere. Tandy will re-propose the other fixes without it. Changing model vendor is the only way to get redaction on that agent.
"This agent was changed while the review was running." Someone saved the agent between the review reading it and you pressing Apply, so nothing was applied — applying would have reverted their change. Run the review again to see the current configuration.
The review found nothing. On a read-only agent with no tools, that's a real result: most of the categories above need tools, keypad capture, or memory to have anything to flag. Tandy lists which categories it checked so you can confirm it looked.
I want the review to change something it won't. That setting isn't one a review can apply, because a review only moves a setting toward the safer value. Ask Tandy for the change directly instead (see Editing with Tandy), or make it in the agent editor.