Paste an agent's declared governance config — its constitution and the scopes it requests — and EcoCloud runs it through the same conformance-tested kernels the platform enforces with: it must declare a real policy, that policy must block forbidden actions and still allow benign ones, it must resist known prompt-injection, and it must ask for least privilege. You get a deterministic, signable pass/fail report. It's a real test, not a badge — a "full" result means it passed this battery, not that it's safe forever.