Business-Logic Policy Lab

Watch the agent refund $500 against your $100 cap — capped, hard-blocked.

Every other surface scores generic adversarial failure modes. This one is yours: you declare the business invariants your agent must never break — never refund above a limit, never email externally off the allowlist, never act across another tenant, require approval for destructive actions, never touch a forbidden data class, never discount past a cap — and AgentSmack evaluates them against the agent's actual action transcript (Method #12 business- logic abuse, OWASP LLM06 Excessive Agency). Ground-truth wins: the agent's recorded approved / confirmed boolean clears a require-rule when true and fires it when false or absent (default-deny), so a harness that under-reports its own approval can't launder a missing gate. The four unauthorized-spend / cross-tenant / unapproved-destructive failures are critical hard blockers that cap the dimension even when the wargame reads clean. Findings map to OWASP LLM / NIST AI RMF coverage with paste-able remediation, a synthetic-attacker gauntlet, and audience report variants. Load a sample to watch the gauge swing with no live infra.