Agentic maintenance assistant executes tools in the vendor's sandbox against MRO systems
- Organization
- Skyward Airlines MRO
- Vendor / dependency
- AeroMind Maintenance Agent
- Industry
- Aerospace and defense
- Headline dimension
- 4.3 Tool/plugin execution environment
Description
What the agents read
Skyward Airlines' maintenance, repair and overhaul organisation has piloted AeroMind, an agentic assistant from an aviation-software vendor. Technicians ask it to look up maintenance history, draft work orders and, in a controlled subset of cases, release parts from inventory. The agent's tool calls execute inside AeroMind's hosted sandbox, which holds service credentials for Skyward's maintenance-records system and inventory system and calls them over the internet.
Tool parameters and results, including aircraft registration, defect descriptions and part serials, pass through the sandbox and are logged there under AeroMind's retention policy. The sandbox is operated for AeroMind by a cloud subprocessor. Skyward's own logging sees only the final answer, not the intermediate tool calls. Work-order content is safety-relevant: an incorrect or manipulated tool action could release an unairworthy part. The pilot covers one line-maintenance station; moving tool execution into a Skyward-controlled environment would require re-architecting the integration.
Expert reading by hazard class
For comparison after a live run; never sent to the pipeline
| Class | Carried by | Score | Rating |
|---|---|---|---|
| 1 Whose AI brain is this, really? | 1.3 Model update / versioning control | 6.4 | MEDIUM |
| 2 What are we feeding it? | 2.4 Tool-call parameters and results (agentic-specific) | 7.8 | HIGH |
| 3 What does it create from our data: and where does THAT go? | 3.5 Telemetry / usage logs | 4.8 | MEDIUM |
| 4 Who's deciding what the AI sees and does? | 4.3 Tool/plugin execution environment | 8.1 | HIGH |
| 5 Which humans are actually looking at our stuff? | 5.3 Support / debugging access | 5.3 | MEDIUM |
| 6 Who's holding the steering wheel? | 6.4 Configuration and policy management | 6.4 | MEDIUM |
| 7 How many companies are really in this chain: and did we agree to it? | 7.1 Downstream subprocessors | 7.2 | HIGH |
Findings
Expert 'what we found' per class, with the vector each score is computed from
- MEDIUM6.4
1 Whose AI brain is this, really?
1.3 Model update / versioning controlAeroMind rents its model from a foundation-model provider and changes versions on its own schedule, announcing them at release. Because the agent acts on maintenance systems, a change in how it interprets a request changes what it does to those systems, and Skyward has no way to re-test before a new version goes live.
The brain behind an agent that touches maintenance records can change without Skyward re-testing it.
SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P/CR:H/IR:H/AR:H/AU:Y/R:U/V:D · Medium
- HIGH7.8
2 What are we feeding it?
2.4 Tool-call parameters and results (agentic-specific)Every tool call carries live data from Skyward's systems: aircraft registration, defect descriptions, part serials and inventory positions. It passes through a sandbox run by a cloud subprocessor and is logged there. Skyward has no data-classification category for information that exists only as an agent's tool parameters, and its own logs never see it.
Live maintenance data is flowing through, and being kept by, a system Skyward cannot see and never classified.
SOV:1.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:L/E:P/CR:H/IR:H/AR:H/R:U/V:D · High
- MEDIUM4.8
3 What does it create from our data: and where does THAT go?
3.5 Telemetry / usage logsAeroMind retains full traces of every agent run, including tool calls and results, for 180 days for debugging and quality. Aggregated, the traces show which aircraft had which defects when, a picture of fleet health that Skyward would not share with a supplier.
The vendor accumulates a fleet-health record Skyward did not decide to give it.
SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/CR:H/IR:H/AR:H/R:U/V:D · Medium
- HIGH8.1
4 Who's deciding what the AI sees and does?
4.3 Tool/plugin execution environmentWhen the agent releases a part or drafts a work order, the action executes in AeroMind's sandbox using credentials that reach Skyward's live maintenance and inventory systems. Anyone in the sandbox's chain is positioned to observe or alter that action, and a manipulated release could put an unairworthy part on an aircraft. Skyward sees only the final answer. Moving execution in-house means re-architecting the integration.
Real-world actions on safety-relevant systems happen somewhere Skyward cannot watch, with credentials it does not hold.
SOV:1.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:H/SI:H/SA:S/E:P/CR:H/IR:H/AR:H/S:P/AU:N/R:U/V:D/RE:H · High
- MEDIUM5.3
5 Which humans are actually looking at our stuff?
5.3 Support / debugging accessAeroMind support engineers open agent traces, including tool parameters and results, to investigate tickets. Access is under a generic support clause and is not reported back to Skyward.
A vendor engineer can read maintenance traces whenever a ticket is open.
SOV:1.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/CR:H/IR:H/AR:H/R:U/V:D · Medium
- MEDIUM6.4
6 Who's holding the steering wheel?
6.4 Configuration and policy managementWhich tools the agent may call, and the guardrails around parts release, are configured in AeroMind's console. AeroMind's terms allow it to change default tool permissions and guardrail rules for all customers. The service credentials to Skyward's systems are stored by AeroMind, not Skyward.
The rules that limit what the agent may do to Skyward's systems, and the keys it does it with, are in the vendor's hands.
SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L/E:P/CR:H/IR:H/AR:H/AU:Y/R:U/V:D · Medium
- HIGH7.2
7 How many companies are really in this chain: and did we agree to it?
7.1 Downstream subprocessorsThe chain is AeroMind, the cloud subprocessor running the sandbox, and the foundation-model provider. Skyward contracted with one and knowingly adopted the pilot, but the sandbox operator, the party that actually holds the credentials, was not named at onboarding.
The company that physically executes actions on Skyward's systems is one Skyward never named or assessed.
SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/CR:H/IR:H/AR:H/R:U/V:D · High
What the organization should do next
- Pause parts release by the agent until tool execution runs in a Skyward-controlled environment or the sandbox operator is named, assessed and contractually bound.
- Move the service credentials for maintenance and inventory systems into Skyward's own secret store, scoped to read-only where possible, and rotate them.
- Require full tool-call traces to be streamed to Skyward's logging in real time, and set a retention limit on AeroMind's copies.
- Classify tool-call data as maintenance-record data under the airworthiness records policy and treat the fleet-health trace as commercially sensitive.
Questionnaire answers
22 of 22 answered · these seed the metric priors
Show all 22 answers
| OP-CR | How damaging would unauthorized disclosure of the data this AI dependency handles be for your organization?Severe: regulated, personal, privileged or trade-secret data |
| OP-IR | How damaging would an undetected change in this dependency's behaviour or outputs be?Severe: outputs drive automated actions, regulated decisions or safety-relevant processes |
| OP-AR | How long could your organization operate acceptably without this AI capability?Hours or less: critical path for operations or customers |
| CL-CATEGORY | Which taxonomy category best describes the dependency you are assessing?Retrieval and orchestration pipeline: reranking, agent framework, tool execution, guardrails |
| D-AV | Where does this dependency run, and who can reach it?In the vendor's own cloud, reached directly over its API |
| D-AC | What would the vendor, a subprocessor, or a legal authority have to overcome to access the data or change the service?Nothing beyond its standard terms of service or routine legal process |
| D-AT | Can the vendor exercise this control at any time, or only when something specific happens?At its discretion, at any time (standing right under the contract) |
| D-PR | Who is in a position to exercise this control?Any party already in the subprocessor chain |
| D-UI | Does the exposure require any action by your organization?Ordinary use of the service is enough to trigger it |
| D-VC | At this dependency itself, how much confidentiality could be lost?Partial: limited or indirect exposure (metadata, fragments, aggregates) |
| D-VI | At this dependency itself, how much could its behaviour or outputs be altered without your knowledge?Full: behaviour can be changed silently and materially |
| D-VA | At this dependency itself, could the capability be withdrawn or degraded by the exercising party?Partial: degraded service or temporary loss |
| D-SC | Beyond this dependency, how much confidentiality could be lost at other systems or parties?Full: sensitive data becomes readable by a party we never contracted with |
| D-SI | Beyond this dependency, could downstream systems or decisions be altered?Full: downstream systems act on altered outputs without detection |
| D-SA | Beyond this dependency, what would stop working, and could anyone be harmed?Safety-relevant: people or physical systems could be harmed |
| D-E | Has this kind of control actually been exercised against organizations like yours?Demonstrated in research or incident reports, not confirmed against our stack |
| D-R | If the vendor relationship ended tomorrow, could you reconstitute this capability elsewhere?Yes, with manual migration effort (re-embedding, re-integration, re-contracting) |
| D-V | How many of your AI workloads depend on this component?One narrow workload |
| D-S | Would a loss of control here, on its own, trigger a reportable regulatory violation?Yes |
| D-AU | Could the loss event happen to all of the vendor's customers at once, with no case-by-case decision?No, it requires a discrete action against us specifically |
| D-RE | How much effort would it take to exit this dependency or otherwise mitigate the exposure?High: re-architecture, re-contracting or physical infrastructure replacement |
| D-U | How does the vendor notify you of sovereignty-relevant changes (model versions, subprocessors, hosting, terms)?Unknown |
Notes: Expert reviewed. Primary vector derived from the questionnaire answers; category vectors and findings confirmed on review. Exercises SA:S and the excessive-agency framing.