Tahr treats access control as a coverage problem across identities, operations, object owners, and tenants, then promotes only proof-backed violations.
Insight: Access control testing should be modeled as coverage across users, tenants, objects, and operations.
A daemon-thread watchdog that escalates through five correction tiers (nudge, redirect, force-wrap, hard stop, terminate) to stop AI pentesting agents from drifting without cutting off legitimate work.
Insight: Long-horizon agents need live drift correction before budget is gone.
We pair every AI testing agent with a second agent that independently re-exploits each finding using statistical verification and drops anything it can't reproduce.
Insight: AI findings need independent re-exploitation before they reach a report.
