Administration / FacilitiesManaged AI Agents
Administration / Facilities AI Agents,
Monitored for Security
Nestack Agent Care helps administration and facilities teams monitor, evaluate, and optimize AI agents used for front-desk support, booking, safety documentation, and vendor coordination — before small AI errors become security or safety issues.
Scope
Administration / Facilities AI agents we build & manage
Twelve archetypes — from front-desk to HVAC optimization and physical-security monitoring.
Visitors & requests4
Facilities & space5
Safety & security3
Observability
What we make observable
Every administration and facilities agent session is traced across ten layers — what we capture and the evidence we keep.
- Evidence we keepGoalconstraintsapproval requirement
- Evidence we keepSourceversiontimestamprelevancecitation
- Evidence we keepPlanned sequenceactual sequenceworkflow status
- Evidence we keepTask statusresultretryfailure reason
- Evidence we keepTool nameversioninputoutputpermissionresult
- Evidence we keepModel/versioninput/outputtoken usagelatencycost
- Evidence we keepEvaluation typemetricthresholdresult
- Evidence we keepGuardrail targettriggeractionenforcement result
- Evidence we keepReviewerdecisioncorrectionreason
- Evidence we keepOutcome statusbusiness resultlinked trace
Catalog
Failure modes
Filter failure modes by where they occur in the agent lifecycle—from goals and retrieval to tools, evaluations, guardrails and outcomes.
ADM-01Physical-security information leaks — codes, layouts, schedules, VIP movementsSEV-1
ADM-02Visitor/badge process errors — unescorted access, skipped screeningSEV-2
ADM-03Safety-procedure misstatement — evacuation, spills, first-aid locationsSEV-1
ADM-04Vendor booking and commitment errorsSEV-2
ADM-05Staff and visitor PII exposure from facilities systemsSEV-2
ADM-06Injection via vendor emails and service requestsSEV-2
ADM-07Hazard mis-triage — gas smells, exposed wiring logged as routine requestsSEV-1
ADM-08Double-booking and resource conflicts — rooms, fleet, AV equipmentSEV-3
ADM-09Mail and courier mis-routing — legal notices and sensitive parcels delayedSEV-2
ADM-10Compliance-calendar misses — fire inspections, elevator certs, permitsSEV-2
ADM-11After-hours access actions without approval — remote unlocks, alarm overridesSEV-1
ADM-12Stale facility data — old floor plans, moved teams, closed areasSEV-3
ADM-13Post-session “hot-mic” capture with auto-broadcast to the invite list · documentedSEV-1
ADM-14Uninvited autonomous meeting attendance (calendar-crawl auto-join) · documentedSEV-1
ADM-15Ambient false-wake nuisance actions — captures / acts on background audio · documentedSEV-3
ADM-16Calendar-invite promptware with physical actuation of building systems · researchSEV-1
ADM-17MCP tool poisoning / post-approval rug-pull on facilities integrations · documentedSEV-1
ADM-18Confused-deputy privilege abuse via the agent’s inherited access · researchSEV-1
ADM-19Over-privileged OAuth token sprawl → cross-system blast radius · documentedSEV-1
ADM-20RAG / knowledge-base poisoning of the facilities knowledge store · researchSEV-2
ADM-21Cross-tenant / cross-user memory bleed in shared agent platform · documentedSEV-1
ADM-22Voice-cloning social engineering of front-desk / help-desk agent · documentedSEV-1
ADM-23Kiosk QR-overlay (quishing) redirection on visitor / parking kiosks · documentedSEV-2
ADM-24Inter-agent identity spoofing / trust escalation across the fleet · researchSEV-1
ADM-25Facilities-agent-mediated OT-to-IT lateral pivot (BMS/PACS bridge) · analogSEV-1
ADM-26Weaponized environmental actuation — thermal / lighting sabotage · emergingSEV-1
ADM-27Energy-optimization AI violates comfort / safety constraints · researchSEV-1
ADM-28Predictive-maintenance false-alarm cascade → alert desensitization · documentedSEV-2
ADM-29PM-optimization deletes load-bearing / warranty-required maintenance · analogSEV-2
ADM-30Hallucinated technical parameters — torque, pressure, part numbers · researchSEV-1
ADM-31Warranty voided by AI-suggested repair path or non-approved part · analogSEV-2
ADM-32Synthetic “ghost-vendor” onboarding — AI-fabricated W-9s, sites, phone agents · documentedSEV-1
ADM-33AI-verified certificate-of-insurance false assurance (forged / lapsed) · analogSEV-2
ADM-34AI invoice extraction + auto-approval → duplicate / misvalued payments · documentedSEV-2
ADM-35IoT-alert-to-work-order storms / runaway ticket loops · documentedSEV-2
ADM-36AI ticket deflection auto-closes facilities requests without resolution · documentedSEV-2
ADM-37AI weapons-screening false negatives from overclaimed detection capability · documentedSEV-1
ADM-38AI gun-detection false positives triggering facility lockdowns · documentedSEV-2
ADM-39False mass-notification / emergency-alert blasts · documentedSEV-1
ADM-40Emergency-assistant scope gap — answers life-safety queries it can’t ground · documentedSEV-1
A · Front-desk & visitor agents
KF-03Stale profile read01 · RetrievalSEV-3
KF-04Category read too narrow02 · ReasoningSEV-1
KF-06Screening match self-answered02 · ReasoningSEV-1
KF-02Weak match passed forward03 · Tool / writeSEV-1
KF-05Bound to the wrong host03 · Tool / writeSEV-2
KF-01Admitted, approval unrecorded04 · OutputSEV-2
KF-07Silent category regression05 · Change / VersionSEV-2
B · Room/resource booking assistants
KG-03Stale availability read01 · RetrievalSEV-3
KG-04Release called too early02 · ReasoningSEV-1
KG-06Sensor reading taken as proof02 · ReasoningSEV-1
KG-02Thin proposal passed forward03 · Tool / writeSEV-1
KG-05Bound to the wrong resource03 · Tool / writeSEV-2
KG-01Released, rule unrecorded04 · OutputSEV-2
KG-07Silent rule regression05 · Change / VersionSEV-2
C · Facilities-request agents
KH-03Stale register read01 · RetrievalSEV-3
KH-04Severity read too low02 · ReasoningSEV-1
KH-06Room taken for the asset02 · ReasoningSEV-1
KH-02Weak match passed forward03 · Tool / writeSEV-1
KH-05Repeat report suppressed03 · Tool / writeSEV-2
KH-01Dispatched, asset unrecorded04 · OutputSEV-2
KH-07Silent severity regression05 · Change / VersionSEV-2
D · Safety-documentation copilots
KI-03Stale stock read01 · RetrievalSEV-3
KI-04Threshold called on old stock02 · ReasoningSEV-1
KI-06Mixture read as one chemical02 · ReasoningSEV-1
KI-02Thin line passed forward03 · Tool / writeSEV-1
KI-05Bound to the wrong store03 · Tool / writeSEV-2
KI-01Certified, evidence unrecorded04 · OutputSEV-2
KI-07Silent threshold regression05 · Change / VersionSEV-2
E · Vendor & maintenance coordinators
KJ-03Stale register read01 · RetrievalSEV-3
KJ-04Interval called current02 · ReasoningSEV-1
KJ-06Wrong edition applied02 · ReasoningSEV-1
KJ-02Thin file passed forward03 · Tool / writeSEV-1
KJ-05Bound to the wrong asset03 · Tool / writeSEV-2
KJ-01Released, evidence unrecorded04 · OutputSEV-2
KJ-07Silent interval regression05 · Change / VersionSEV-2
F · Energy & HVAC-optimization agents
KK-03Stale charge read01 · RetrievalSEV-3
KK-04Leak rate computed early02 · ReasoningSEV-1
KK-06Wrong part applied02 · ReasoningSEV-1
KK-02Thin file passed forward03 · Tool / writeSEV-1
KK-05Bound to the wrong appliance03 · Tool / writeSEV-2
KK-01Signed, evidence unrecorded04 · OutputSEV-2
KK-07Silent clock regression05 · Change / VersionSEV-2
G · Space-utilization copilots
KN-03Stale floor plan read01 · RetrievalSEV-3
KN-04Utilisation asserted, not covered02 · ReasoningSEV-1
KN-06Methods mixed across zones02 · ReasoningSEV-1
KN-02Thin study passed forward03 · Tool / writeSEV-1
KN-05Bound to the wrong zone03 · Tool / writeSEV-2
KN-01Published, coverage unstated04 · OutputSEV-2
KN-07Silent coverage regression05 · Change / VersionSEV-2
H · Physical-security monitoring agents
KP-03Stale device list read01 · RetrievalSEV-3
KP-04Bound to the wrong door02 · ReasoningSEV-1
KP-06Silence read as all clear02 · ReasoningSEV-1
KP-02Thin event passed forward03 · Tool / writeSEV-1
KP-05Filed against the wrong site03 · Tool / writeSEV-2
KP-01Dispositioned, evidence unrecorded04 · OutputSEV-2
KP-07Silent correlation regression05 · Change / VersionSEV-2
I · EHS-incident agents
KR-03Stale roster read01 · RetrievalSEV-3
KR-04Recordability called early02 · ReasoningSEV-1
KR-06First aid read as treatment02 · ReasoningSEV-1
KR-02Thin case passed forward03 · Tool / writeSEV-1
KR-05Bound to the wrong establishment03 · Tool / writeSEV-2
KR-01Certified, evidence unrecorded04 · OutputSEV-2
KR-07Silent clock regression05 · Change / VersionSEV-2
J · Mailroom & package-logistics agents
KS-03Stale directory read01 · RetrievalSEV-3
KS-04Recipient matched loosely02 · ReasoningSEV-1
KS-06Handling route ignored02 · ReasoningSEV-1
KS-02Thin chain passed forward03 · Tool / writeSEV-1
KS-05Bound to the wrong site03 · Tool / writeSEV-2
KS-01Released, custody unrecorded04 · OutputSEV-2
KS-07Silent route regression05 · Change / VersionSEV-2
K · Cleaning-robotics coordination helpers
KT-03Stale occupancy read01 · RetrievalSEV-3
KT-04Run called done, not covered02 · ReasoningSEV-1
KT-06Closed zone read as open02 · ReasoningSEV-1
KT-02Thin plan passed forward03 · Tool / writeSEV-1
KT-05Filed against the wrong unit03 · Tool / writeSEV-2
KT-01Released, coverage unrecorded04 · OutputSEV-2
KT-07Silent zoning regression05 · Change / VersionSEV-2
L · Lease-administration copilots
KU-03Stale abstract read01 · RetrievalSEV-3
KU-04Window closed too early02 · ReasoningSEV-1
KU-06Ambiguity resolved silently02 · ReasoningSEV-1
KU-02Thin window passed forward03 · Tool / writeSEV-1
KU-05Bound to the wrong demise03 · Tool / writeSEV-2
KU-01Approved, clause unrecorded04 · OutputSEV-2
KU-07Silent diary regression05 · Change / VersionSEV-2
Guardrails
Critical guardrails for Admin & facilities agents
Ten controls that hold regardless of prompt, plan or pressure. Open one to see what it protects, what trips it, what the agent is forced to do, who may release it, and what is written to the record.
GR-01No after-hours unlock without duty-manager approvalOverride defined
Target
Remote door releases, alarm overrides and out-of-hours badge activations across all managed sites.
Trigger
Any unlock, alarm override or badge activation requested outside the site’s published operating hours.
Action — enforced
Platform holds the release, pages the on-call duty manager, and lets the agent log the request and notify security only.
Human override
Duty manager on call via signed release in the physical-access console.
Logged evidencerequest id · door and site id · requester identity · duty-manager approval id · unlock timestamp · alarm state before/after
GR-02No disclosure of access codes, layouts or schedulesNo override
Target
Door codes, master-key registers, floor plans, guard rosters and executive movement schedules.
Trigger
Any prompt or draft that would place physical-security detail in an outbound channel.
Action — enforced
Platform blocks the response, strips the detail from context, and routes the requester to the physical-security team.
Human override
None — cannot be overridden in session
Logged evidenceblocked-response hash · requester identity · data classification · channel and timestamp · escalation ticket id
GR-03No instruction embedded in inbound vendor content ever executedNo override
Target
Vendor emails, service requests, work orders and attachments ingested by facilities agents.
Trigger
Directive text detected inside ingested content — hidden text, footers, form fields or attachments.
Action — enforced
Platform treats the content as data only, quarantines the artifact, and continues the workflow on trusted inputs alone.
Human override
None — cannot be overridden in session
Logged evidenceartifact hash · detected payload excerpt · source address · quarantine id · parser version · timestamp
GR-04No downgrade of a reported hazard to routineOverride defined
Target
Service-desk intake for gas smells, exposed wiring, water ingress and structural damage reports.
Trigger
Any classification below urgent for keywords or images matching the site hazard taxonomy.
Action — enforced
Platform forces the highest matching severity, dispatches the safety officer, and blocks closure until a human inspection is logged.
Human override
Facilities safety officer via documented reclassification with an inspection reference.
Logged evidenceticket id · original wording · assigned severity · dispatch timestamp · inspector identity
GR-05No safety guidance outside controlled procedure documentsOverride defined
Target
Evacuation routes, spill response, first-aid locations and incident procedures quoted to staff.
Trigger
A safety answer drafted from any source other than the current controlled document set.
Action — enforced
Platform blocks the draft, serves the controlled document verbatim with its version, and flags gaps to the safety team.
Human override
EHS manager via publication of an updated controlled document.
Logged evidencedocument id and version · query text · served excerpt hash · requester identity · timestamp
GR-06No badge issued without completed visitor screeningOverride defined
Target
Visitor registration, badge printing, escort assignment and watchlist checks at every reception point.
Trigger
A badge or access request missing screening, host confirmation or escort assignment.
Action — enforced
Platform denies badge activation, notifies the host, and holds the visitor record in pending until screening completes.
Human override
Site security lead via screening waiver recorded against the visit.
Logged evidencevisit id · screening result · host identity · escort assignment · badge id and zone scope
GR-07No release of visitor or staff movement dataOverride defined
Target
Badge logs, visitor histories, desk bookings and fleet telemetry held in facilities systems.
Trigger
Any request for movement or presence data beyond the requester’s lawful role.
Action — enforced
Platform refuses the export, returns aggregate counts only, and records the attempt for the privacy officer.
Human override
Privacy officer via documented lawful-basis approval attached to the request.
Logged evidencerequest id · requester role · data scope · refusal timestamp · privacy-review ticket
GR-08No vendor commitment without a purchase authorisationOverride defined
Target
Contractor bookings, maintenance call-outs, catering and equipment hire placed with external vendors.
Trigger
Any order, booking or variation lacking an approved PO or facilities budget code.
Action — enforced
Platform blocks the send, drafts the request for approval, and books only after the authorisation reference attaches.
Human override
Facilities manager via approved purchase order in the procurement system.
Logged evidencevendor id · quote amount · PO reference · approver identity · booking timestamp
GR-09No closure of statutory inspection tasks without certificatesOverride defined
Target
Fire inspections, elevator certifications, permit renewals and other dated statutory obligations per site.
Trigger
A compliance task marked complete without a current certificate or inspection report attached.
Action — enforced
Platform reopens the task, escalates at set intervals before the due date, and blocks suppression of reminders.
Human override
Compliance owner via uploaded certificate validated against the statutory register.
Logged evidencetask id · statute reference · due date · certificate hash · escalation trail
GR-10No routing from superseded floor plans or occupancy dataOverride defined
Target
Mail and courier routing, legal-notice delivery, moves and space allocations across sites.
Trigger
A routing or booking decision referencing a plan or roster past its review date.
Action — enforced
Platform blocks the route, requires refresh from the master facility record, and flags sensitive parcels for tracked handoff.
Human override
Facilities data steward via revalidation of the master record version.
Logged evidenceplan version and date · parcel or move id · refreshed record id · handoff signature · timestamp
Oversight
Human review — triggers, decisions and evidence
When a defined risk trigger fires, the affected action is routed to a named reviewer. Every decision is recorded with its correction, escalation and final outcome for full traceability.
- ConfidenceLow-confidence hazard triage
- Financial impactVendor booking commitment
- Identity / change riskBadge or access change
- Irreversible actionAfter-hours unlock action
- Policy riskSafety or permit conflict
- Safety controlGuardrail override
- Quality failureFailed critical evaluation
- Revieweridentity + role
- Decisionapprove / reject / amend
- Correctionwhat changed
- Escalationwho, why and severity
- Final outcomereleased / blocked / returned for rework
7 triggers · any one halts the agent
1 record · 5 fields, every time
Compliance
Regulatory mapping
- 01 Goal
- 02 Retrieval
- 06 LLM
- 07 Evaluation
- 08 Guardrail
Physical security
Access codes, layouts and schedules are attack-planning material.
Lifecycle layer:01 Goal · 07 Evaluation · 08 Guardrail
- ADM-01
Evaluations
Baseline evaluation suite — in detail
Baseline evaluations are completed during onboarding and repeated based on the selected plan. Agents that fail critical checks remain restricted until they pass re-testing.
- Detailed case sets
- 29
- Failure modes covered
- 40
- Retired & rotated / quarter
- 10%
- Audit-ready scorecard
- Monthly
Output evaluation1 suite · 50 cases
60 casesSecurity-info controlcatches ADM-01
60 casesSafety-procedure groundingcatches ADM-03
60 casesBooking accuracycatches ADM-02
40 casesVendor authoritycatches ADM-04
40 casesVisitor privacycatches ADM-05
40 patternsInjection suitecatches ADM-06
50 casesHazard-triage setcatches ADM-07
40 casesBooking-conflict setcatches ADM-08
40 casesMail-routing setcatches ADM-09
40 casesObligation-tracking setcatches ADM-10
40 casesAccess-action gatingcatches ADM-11
40 casesFacility-freshness setcatches ADM-12
Use your work email to unlock the full grid. We use it to send the requested Agent Care material and qualify business inquiries. We do not sell or share your email.
Department lead review
For applicable high-risk agents, the client’s designated department leader reviews the evaluation criteria and pass thresholds before baseline approval.
Test-case rotation
Evaluation cases are refreshed regularly to reduce memorisation and maintain reliable performance measurement.
Scorecard integration
Scorecards track results against the approved baseline and flag material declines for review and escalation.
Department-specific extensions
Where included in scope, evaluations may be expanded using approved workflows, tools, templates, policies, and incident history.
Monitoring
Change-aware monitoring
When agent performance changes, Nestack correlates the shift with changes to the agent, prompt, model, tools, knowledge base, guardrails and evaluation suite.
- Week 1 · 97.9%
- Week 2 · 97.8%
- Week 3 · 98.0%
- Week 4 · 97.9%
- Week 5 · 98.1%
- Week 6 · 97.9%
- Week 7 · 98.0%
- Week 8 · 94.3%
- Week 9 · 94.1%
- Week 10 · 97.9%
- Week 11 · 98.0%
- Week 12 · 98.1%
Week readouthover or select
Week 8of 12
- 05Knowledge-basekb 2026.07
94.3%Facility-currency rate
- 7 layers stamped on every run · 12-week window
- Catches ADM-12 · stale facility data
Something missing?
Don’t see your agent’s issue here?
Every AI environment is different. Share what you’re seeing, and we’ll review the behaviour, assess the risk and recommend the evaluations or controls that may help.
No commitment. Even if you never become a client, we’ll tell you what we think is happening.
Process
Universal incident runbook
Severity is assigned based on business impact, customer harm, data exposure, operational disruption and overall scope.
- SEV-1 Critical
- SEV-2 Major
- SEV-3 Moderate
- SEV-4 Minor
Automated monitoring or human review identifies unusual behaviour. Alerts are recorded and routed according to severity.
Cost control
Keep administration / facilities AI agent costs under control
Token spend is monitored, optimised and reported as part of Agent Care — and savings never come at the expense of quality, because every change is verified against your evaluation baseline.
We review token spend by agent, workflow, model, and session so you can understand where AI costs are coming from.
Running administration / facilities AI agents in production?
Get a free assessment of one agent. We’ll review its behaviour, run a baseline evaluation and highlight potential risks and performance gaps.
Loading open times…
Open times
Select an available date above to view open 45-minute times from our calendar.
