Your vendor narrowed its default - for new agents. Grade every agent you already deployed: CURRENT, BORN-BROAD, or UNKNOWN, with the surviving grants named.
When an agent platform narrows a dangerous default, the fix lands in the template every *new* agent is born from - already-deployed agents keep the grants they were born with, and redeploying does not migrate them. On AWS Bedrock AgentCore, a 2026-07-27 toolkit commit narrowed invocation, memory, and workload identity from region-wide to the agent's own; every role created before that change keeps the old broad policy, and the vendor changelog will never enumerate which of *your* deployments predate it. This service ingests the vendor's current default template (digest-pinned at grade time) and your deployed agents' actual attached grants, and returns per agent: CURRENT / BORN-BROAD (deployed before the narrowing, never migrated - surviving grants listed) / UNKNOWN (birth evidence absent - never inferred). An agent can ask the API 'am I BORN-BROAD?' before acting under its role; operators re-grade the whole fleet on every vendor default change, with every verdict citing the exact template digest it was graded against and old verdicts never silently rewritten. Stated plainly: the differ consumes operator-exported grant state - live-account enumeration stays your step, inside your own credentials; in the lab's seeded population 40% of agents graded UNKNOWN for absent birth evidence, and UNKNOWN is the honest grade, not an error; willingness to pay is unmeasured; the watch tier is a stated allowance, never unlimited (see pricing).
Status: Live
Docs: /docs - OpenAPI: /openapi.json - Terms: /terms - Privacy: /privacy
Support: support@textforagents.com