Administration / FacilitiesManaged AI Agents

Administration / Facilities AI Agents,
Monitored for Security

Nestack Agent Care helps administration and facilities teams monitor, evaluate, and optimize AI agents used for front-desk support, booking, safety documentation, and vendor coordination — before small AI errors become security or safety issues.

124failure modes
57SEV-1 failure modes
550+baseline eval cases
24/7Agent Monitoring

Scope

Administration / Facilities AI agents we build & manage

Twelve archetypes — from front-desk to HVAC optimization and physical-security monitoring.

Observability

What we make observable

Every administration and facilities agent session is traced across ten layers — what we capture and the evidence we keep.

  1. Evidence we keep
    Goalconstraintsapproval requirement
  2. Evidence we keep
    Sourceversiontimestamprelevancecitation
  3. Evidence we keep
    Planned sequenceactual sequenceworkflow status
  4. Evidence we keep
    Task statusresultretryfailure reason
  5. Evidence we keep
    Tool nameversioninputoutputpermissionresult
  6. Evidence we keep
    Model/versioninput/outputtoken usagelatencycost
  7. Evidence we keep
    Evaluation typemetricthresholdresult
  8. Evidence we keep
    Guardrail targettriggeractionenforcement result
  9. Evidence we keep
    Reviewerdecisioncorrectionreason
  10. Evidence we keep
    Outcome statusbusiness resultlinked trace

Catalog

Failure modes

Filter failure modes by where they occur in the agent lifecycle—from goals and retrieval to tools, evaluations, guardrails and outcomes.

Nothing on this page matches that. Try a layer (tool, retrieval, guardrail), a code, or a severity.

0 documented↑↓ move · ↵ open · ⌘↵ filter matrix
124 documented · select a cell to filter
25
38
34
18
35
10
57
65
37
53
ADM-01Physical-security information leaks — codes, layouts, schedules, VIP movementsSEV-1
ADM-02Visitor/badge process errors — unescorted access, skipped screeningSEV-2
ADM-03Safety-procedure misstatement — evacuation, spills, first-aid locationsSEV-1
ADM-04Vendor booking and commitment errorsSEV-2
ADM-05Staff and visitor PII exposure from facilities systemsSEV-2
ADM-06Injection via vendor emails and service requestsSEV-2
ADM-07Hazard mis-triage — gas smells, exposed wiring logged as routine requestsSEV-1
ADM-08Double-booking and resource conflicts — rooms, fleet, AV equipmentSEV-3
ADM-09Mail and courier mis-routing — legal notices and sensitive parcels delayedSEV-2
ADM-10Compliance-calendar misses — fire inspections, elevator certs, permitsSEV-2
ADM-11After-hours access actions without approval — remote unlocks, alarm overridesSEV-1
ADM-12Stale facility data — old floor plans, moved teams, closed areasSEV-3
ADM-13Post-session “hot-mic” capture with auto-broadcast to the invite list · documentedSEV-1
ADM-14Uninvited autonomous meeting attendance (calendar-crawl auto-join) · documentedSEV-1
ADM-15Ambient false-wake nuisance actions — captures / acts on background audio · documentedSEV-3
ADM-16Calendar-invite promptware with physical actuation of building systems · researchSEV-1
ADM-17MCP tool poisoning / post-approval rug-pull on facilities integrations · documentedSEV-1
ADM-18Confused-deputy privilege abuse via the agent’s inherited access · researchSEV-1
ADM-19Over-privileged OAuth token sprawl → cross-system blast radius · documentedSEV-1
ADM-20RAG / knowledge-base poisoning of the facilities knowledge store · researchSEV-2
ADM-21Cross-tenant / cross-user memory bleed in shared agent platform · documentedSEV-1
ADM-22Voice-cloning social engineering of front-desk / help-desk agent · documentedSEV-1
ADM-23Kiosk QR-overlay (quishing) redirection on visitor / parking kiosks · documentedSEV-2
ADM-24Inter-agent identity spoofing / trust escalation across the fleet · researchSEV-1
ADM-25Facilities-agent-mediated OT-to-IT lateral pivot (BMS/PACS bridge) · analogSEV-1
ADM-26Weaponized environmental actuation — thermal / lighting sabotage · emergingSEV-1
ADM-27Energy-optimization AI violates comfort / safety constraints · researchSEV-1
ADM-28Predictive-maintenance false-alarm cascade → alert desensitization · documentedSEV-2
ADM-29PM-optimization deletes load-bearing / warranty-required maintenance · analogSEV-2
ADM-30Hallucinated technical parameters — torque, pressure, part numbers · researchSEV-1
ADM-31Warranty voided by AI-suggested repair path or non-approved part · analogSEV-2
ADM-32Synthetic “ghost-vendor” onboarding — AI-fabricated W-9s, sites, phone agents · documentedSEV-1
ADM-33AI-verified certificate-of-insurance false assurance (forged / lapsed) · analogSEV-2
ADM-34AI invoice extraction + auto-approval → duplicate / misvalued payments · documentedSEV-2
ADM-35IoT-alert-to-work-order storms / runaway ticket loops · documentedSEV-2
ADM-36AI ticket deflection auto-closes facilities requests without resolution · documentedSEV-2
ADM-37AI weapons-screening false negatives from overclaimed detection capability · documentedSEV-1
ADM-38AI gun-detection false positives triggering facility lockdowns · documentedSEV-2
ADM-39False mass-notification / emergency-alert blasts · documentedSEV-1
ADM-40Emergency-assistant scope gap — answers life-safety queries it can’t ground · documentedSEV-1

A · Front-desk & visitor agents

KF-03Stale profile read01 · RetrievalSEV-3
KF-04Category read too narrow02 · ReasoningSEV-1
KF-06Screening match self-answered02 · ReasoningSEV-1
KF-02Weak match passed forward03 · Tool / writeSEV-1
KF-05Bound to the wrong host03 · Tool / writeSEV-2
KF-01Admitted, approval unrecorded04 · OutputSEV-2
KF-07Silent category regression05 · Change / VersionSEV-2

B · Room/resource booking assistants

KG-03Stale availability read01 · RetrievalSEV-3
KG-04Release called too early02 · ReasoningSEV-1
KG-06Sensor reading taken as proof02 · ReasoningSEV-1
KG-02Thin proposal passed forward03 · Tool / writeSEV-1
KG-05Bound to the wrong resource03 · Tool / writeSEV-2
KG-01Released, rule unrecorded04 · OutputSEV-2
KG-07Silent rule regression05 · Change / VersionSEV-2

C · Facilities-request agents

KH-03Stale register read01 · RetrievalSEV-3
KH-04Severity read too low02 · ReasoningSEV-1
KH-06Room taken for the asset02 · ReasoningSEV-1
KH-02Weak match passed forward03 · Tool / writeSEV-1
KH-05Repeat report suppressed03 · Tool / writeSEV-2
KH-01Dispatched, asset unrecorded04 · OutputSEV-2
KH-07Silent severity regression05 · Change / VersionSEV-2

D · Safety-documentation copilots

KI-03Stale stock read01 · RetrievalSEV-3
KI-04Threshold called on old stock02 · ReasoningSEV-1
KI-06Mixture read as one chemical02 · ReasoningSEV-1
KI-02Thin line passed forward03 · Tool / writeSEV-1
KI-05Bound to the wrong store03 · Tool / writeSEV-2
KI-01Certified, evidence unrecorded04 · OutputSEV-2
KI-07Silent threshold regression05 · Change / VersionSEV-2

E · Vendor & maintenance coordinators

KJ-03Stale register read01 · RetrievalSEV-3
KJ-04Interval called current02 · ReasoningSEV-1
KJ-06Wrong edition applied02 · ReasoningSEV-1
KJ-02Thin file passed forward03 · Tool / writeSEV-1
KJ-05Bound to the wrong asset03 · Tool / writeSEV-2
KJ-01Released, evidence unrecorded04 · OutputSEV-2
KJ-07Silent interval regression05 · Change / VersionSEV-2

F · Energy & HVAC-optimization agents

KK-03Stale charge read01 · RetrievalSEV-3
KK-04Leak rate computed early02 · ReasoningSEV-1
KK-06Wrong part applied02 · ReasoningSEV-1
KK-02Thin file passed forward03 · Tool / writeSEV-1
KK-05Bound to the wrong appliance03 · Tool / writeSEV-2
KK-01Signed, evidence unrecorded04 · OutputSEV-2
KK-07Silent clock regression05 · Change / VersionSEV-2

G · Space-utilization copilots

KN-03Stale floor plan read01 · RetrievalSEV-3
KN-04Utilisation asserted, not covered02 · ReasoningSEV-1
KN-06Methods mixed across zones02 · ReasoningSEV-1
KN-02Thin study passed forward03 · Tool / writeSEV-1
KN-05Bound to the wrong zone03 · Tool / writeSEV-2
KN-01Published, coverage unstated04 · OutputSEV-2
KN-07Silent coverage regression05 · Change / VersionSEV-2

H · Physical-security monitoring agents

KP-03Stale device list read01 · RetrievalSEV-3
KP-04Bound to the wrong door02 · ReasoningSEV-1
KP-06Silence read as all clear02 · ReasoningSEV-1
KP-02Thin event passed forward03 · Tool / writeSEV-1
KP-05Filed against the wrong site03 · Tool / writeSEV-2
KP-01Dispositioned, evidence unrecorded04 · OutputSEV-2
KP-07Silent correlation regression05 · Change / VersionSEV-2

I · EHS-incident agents

KR-03Stale roster read01 · RetrievalSEV-3
KR-04Recordability called early02 · ReasoningSEV-1
KR-06First aid read as treatment02 · ReasoningSEV-1
KR-02Thin case passed forward03 · Tool / writeSEV-1
KR-05Bound to the wrong establishment03 · Tool / writeSEV-2
KR-01Certified, evidence unrecorded04 · OutputSEV-2
KR-07Silent clock regression05 · Change / VersionSEV-2

J · Mailroom & package-logistics agents

KS-03Stale directory read01 · RetrievalSEV-3
KS-04Recipient matched loosely02 · ReasoningSEV-1
KS-06Handling route ignored02 · ReasoningSEV-1
KS-02Thin chain passed forward03 · Tool / writeSEV-1
KS-05Bound to the wrong site03 · Tool / writeSEV-2
KS-01Released, custody unrecorded04 · OutputSEV-2
KS-07Silent route regression05 · Change / VersionSEV-2

K · Cleaning-robotics coordination helpers

KT-03Stale occupancy read01 · RetrievalSEV-3
KT-04Run called done, not covered02 · ReasoningSEV-1
KT-06Closed zone read as open02 · ReasoningSEV-1
KT-02Thin plan passed forward03 · Tool / writeSEV-1
KT-05Filed against the wrong unit03 · Tool / writeSEV-2
KT-01Released, coverage unrecorded04 · OutputSEV-2
KT-07Silent zoning regression05 · Change / VersionSEV-2

L · Lease-administration copilots

KU-03Stale abstract read01 · RetrievalSEV-3
KU-04Window closed too early02 · ReasoningSEV-1
KU-06Ambiguity resolved silently02 · ReasoningSEV-1
KU-02Thin window passed forward03 · Tool / writeSEV-1
KU-05Bound to the wrong demise03 · Tool / writeSEV-2
KU-01Approved, clause unrecorded04 · OutputSEV-2
KU-07Silent diary regression05 · Change / VersionSEV-2

Guardrails

Critical guardrails for Admin & facilities agents

Ten controls that hold regardless of prompt, plan or pressure. Open one to see what it protects, what trips it, what the agent is forced to do, who may release it, and what is written to the record.

GR-01No after-hours unlock without duty-manager approvalOverride defined
  1. Target

    Remote door releases, alarm overrides and out-of-hours badge activations across all managed sites.

  2. Trigger

    Any unlock, alarm override or badge activation requested outside the site’s published operating hours.

  3. Action — enforced

    Platform holds the release, pages the on-call duty manager, and lets the agent log the request and notify security only.

  4. Human override

    Duty manager on call via signed release in the physical-access console.

Logged evidencerequest id · door and site id · requester identity · duty-manager approval id · unlock timestamp · alarm state before/after

GR-02No disclosure of access codes, layouts or schedulesNo override
  1. Target

    Door codes, master-key registers, floor plans, guard rosters and executive movement schedules.

  2. Trigger

    Any prompt or draft that would place physical-security detail in an outbound channel.

  3. Action — enforced

    Platform blocks the response, strips the detail from context, and routes the requester to the physical-security team.

  4. Human override

    None — cannot be overridden in session

Logged evidenceblocked-response hash · requester identity · data classification · channel and timestamp · escalation ticket id

GR-03No instruction embedded in inbound vendor content ever executedNo override
  1. Target

    Vendor emails, service requests, work orders and attachments ingested by facilities agents.

  2. Trigger

    Directive text detected inside ingested content — hidden text, footers, form fields or attachments.

  3. Action — enforced

    Platform treats the content as data only, quarantines the artifact, and continues the workflow on trusted inputs alone.

  4. Human override

    None — cannot be overridden in session

Logged evidenceartifact hash · detected payload excerpt · source address · quarantine id · parser version · timestamp

GR-04No downgrade of a reported hazard to routineOverride defined
  1. Target

    Service-desk intake for gas smells, exposed wiring, water ingress and structural damage reports.

  2. Trigger

    Any classification below urgent for keywords or images matching the site hazard taxonomy.

  3. Action — enforced

    Platform forces the highest matching severity, dispatches the safety officer, and blocks closure until a human inspection is logged.

  4. Human override

    Facilities safety officer via documented reclassification with an inspection reference.

Logged evidenceticket id · original wording · assigned severity · dispatch timestamp · inspector identity

GR-05No safety guidance outside controlled procedure documentsOverride defined
  1. Target

    Evacuation routes, spill response, first-aid locations and incident procedures quoted to staff.

  2. Trigger

    A safety answer drafted from any source other than the current controlled document set.

  3. Action — enforced

    Platform blocks the draft, serves the controlled document verbatim with its version, and flags gaps to the safety team.

  4. Human override

    EHS manager via publication of an updated controlled document.

Logged evidencedocument id and version · query text · served excerpt hash · requester identity · timestamp

GR-06No badge issued without completed visitor screeningOverride defined
  1. Target

    Visitor registration, badge printing, escort assignment and watchlist checks at every reception point.

  2. Trigger

    A badge or access request missing screening, host confirmation or escort assignment.

  3. Action — enforced

    Platform denies badge activation, notifies the host, and holds the visitor record in pending until screening completes.

  4. Human override

    Site security lead via screening waiver recorded against the visit.

Logged evidencevisit id · screening result · host identity · escort assignment · badge id and zone scope

GR-07No release of visitor or staff movement dataOverride defined
  1. Target

    Badge logs, visitor histories, desk bookings and fleet telemetry held in facilities systems.

  2. Trigger

    Any request for movement or presence data beyond the requester’s lawful role.

  3. Action — enforced

    Platform refuses the export, returns aggregate counts only, and records the attempt for the privacy officer.

  4. Human override

    Privacy officer via documented lawful-basis approval attached to the request.

Logged evidencerequest id · requester role · data scope · refusal timestamp · privacy-review ticket

GR-08No vendor commitment without a purchase authorisationOverride defined
  1. Target

    Contractor bookings, maintenance call-outs, catering and equipment hire placed with external vendors.

  2. Trigger

    Any order, booking or variation lacking an approved PO or facilities budget code.

  3. Action — enforced

    Platform blocks the send, drafts the request for approval, and books only after the authorisation reference attaches.

  4. Human override

    Facilities manager via approved purchase order in the procurement system.

Logged evidencevendor id · quote amount · PO reference · approver identity · booking timestamp

GR-09No closure of statutory inspection tasks without certificatesOverride defined
  1. Target

    Fire inspections, elevator certifications, permit renewals and other dated statutory obligations per site.

  2. Trigger

    A compliance task marked complete without a current certificate or inspection report attached.

  3. Action — enforced

    Platform reopens the task, escalates at set intervals before the due date, and blocks suppression of reminders.

  4. Human override

    Compliance owner via uploaded certificate validated against the statutory register.

Logged evidencetask id · statute reference · due date · certificate hash · escalation trail

GR-10No routing from superseded floor plans or occupancy dataOverride defined
  1. Target

    Mail and courier routing, legal-notice delivery, moves and space allocations across sites.

  2. Trigger

    A routing or booking decision referencing a plan or roster past its review date.

  3. Action — enforced

    Platform blocks the route, requires refresh from the master facility record, and flags sensitive parcels for tracked handoff.

  4. Human override

    Facilities data steward via revalidation of the master record version.

Logged evidenceplan version and date · parcel or move id · refreshed record id · handoff signature · timestamp

Oversight

Human review — triggers, decisions and evidence

When a defined risk trigger fires, the affected action is routed to a named reviewer. Every decision is recorded with its correction, escalation and final outcome for full traceability.

  • ConfidenceLow-confidence hazard triage
  • Financial impactVendor booking commitment
  • Identity / change riskBadge or access change
  • Irreversible actionAfter-hours unlock action
  • Policy riskSafety or permit conflict
  • Safety controlGuardrail override
  • Quality failureFailed critical evaluation
Humanreviewnamed reviewer
  • Revieweridentity + role
  • Decisionapprove / reject / amend
  • Correctionwhat changed
  • Escalationwho, why and severity
  • Final outcomereleased / blocked / returned for rework

7 triggers · any one halts the agent

1 record · 5 fields, every time

Compliance

Regulatory mapping

  • 01 Goal
  • 02 Retrieval
  • 06 LLM
  • 07 Evaluation
  • 08 Guardrail

Physical security

Access codes, layouts and schedules are attack-planning material.

Lifecycle layer:01 Goal · 07 Evaluation · 08 Guardrail

  • ADM-01

Evaluations

Baseline evaluation suite — in detail

Baseline evaluations are completed during onboarding and repeated based on the selected plan. Agents that fail critical checks remain restricted until they pass re-testing.

Detailed case sets
29
Failure modes covered
40
Retired & rotated / quarter
10%
Audit-ready scorecard
Monthly

Output evaluation1 suite · 50 cases

50 casesHazard-triage setcatches ADM-07

Use your work email to unlock the full grid. We use it to send the requested Agent Care material and qualify business inquiries. We do not sell or share your email.

  1. Department lead review

    For applicable high-risk agents, the client’s designated department leader reviews the evaluation criteria and pass thresholds before baseline approval.

  2. Test-case rotation

    Evaluation cases are refreshed regularly to reduce memorisation and maintain reliable performance measurement.

  3. Scorecard integration

    Scorecards track results against the approved baseline and flag material declines for review and escalation.

  4. Department-specific extensions

    Where included in scope, evaluations may be expanded using approved workflows, tools, templates, policies, and incident history.

Monitoring

Change-aware monitoring

When agent performance changes, Nestack correlates the shift with changes to the agent, prompt, model, tools, knowledge base, guardrails and evaluation suite.

Version changes by layer
01AgentAgent changed in week 3
02PromptPrompt changed in week 5Prompt changed in week 10
03ModelModel changed in week 4
04ToolTool changed in week 6Tool changed in week 12
05Knowledge-baseKnowledge-base changed in week 8Knowledge-base changed in week 10
06GuardrailGuardrail changed in week 10
07Eval-suiteEval-suite changed in week 3
Facility-currency rate92–100%
  • Week 1 · 97.9%
  • Week 2 · 97.8%
  • Week 3 · 98.0%
  • Week 4 · 97.9%
  • Week 5 · 98.1%
  • Week 6 · 97.9%
  • Week 7 · 98.0%
  • Week 8 · 94.3%
  • Week 9 · 94.1%
  • Week 10 · 97.9%
  • Week 11 · 98.0%
  • Week 12 · 98.1%

Week readouthover or select

Week 8of 12

  • 05Knowledge-basekb 2026.07

94.3%Facility-currency rate

  • 7 layers stamped on every run · 12-week window
  • Catches ADM-12 · stale facility data

Something missing?

Don’t see your agent’s issue here?

Every AI environment is different. Share what you’re seeing, and we’ll review the behaviour, assess the risk and recommend the evaluations or controls that may help.

Report an agent issue

Tell us what you’re seeing

The more specific, the faster we can reproduce it. Playbook: Administration / Facilities

We reply within one business day.

See pricing

No commitment. Even if you never become a client, we’ll tell you what we think is happening.

Process

Universal incident runbook

Severity is assigned based on business impact, customer harm, data exposure, operational disruption and overall scope.

  • SEV-1 Critical
  • SEV-2 Major
  • SEV-3 Moderate
  • SEV-4 Minor
STEP 01

Automated monitoring or human review identifies unusual behaviour. Alerts are recorded and routed according to severity.

Cost control

Keep administration / facilities AI agent costs under control

Token spend is monitored, optimised and reported as part of Agent Care — and savings never come at the expense of quality, because every change is verified against your evaluation baseline.

We review token spend by agent, workflow, model, and session so you can understand where AI costs are coming from.

Running administration / facilities AI agents in production?

Get a free assessment of one agent. We’ll review its behaviour, run a baseline evaluation and highlight potential risks and performance gaps.

Loading open times…

Open times

Select an available date above to view open 45-minute times from our calendar.