Caddygo

Are scope, spend, and authority enforced while the agent runs?

Authority is bounded at run time by OAuth grant scoping and one hard product limit: the page states Caddygo connects under "the narrowest grants the agents can work with" (mail read, draft, file access, each enumerated with its purpose) and that it "only ever writes drafts and never sends email, so sending stays with you." A structural bar on the highest-consequence action is real enforcement, not a policy statement. Held below 3: no spend control, no per-run or per-project caps, no administrator-configurable limits, and no independent attestation that the scoping is enforced as described.

Our automated recount on Sep 18, 2026 counted enough evidenced fields for 1/3. It never reads what those fields say, so it does not overturn the score above, judged on Sep 18, 2026 — but where the two disagree it is a reason to read this dimension again. Why there are two scores

Counts Action space and Permission scopes, each cited below.

Is there a tamper-evident record of what it actually did?

A reviewable record exists and sits in systems the customer controls: "The full audit trail stays in your inbox and SharePoint." That is customer-reviewable, which clears 0. It is ordinary mail and SharePoint content, so nothing is tamper-evident, hash-chained, or independently verifiable, and the page describes no immutable log of agent actions as distinct from the documents they produce.

Counts Audit trail, each cited below.

Are compliance obligations attached per engagement?

A compliance posture is published but no certification is held. The page states "We are GDPR-compliant, and SOC 2 and ISO 27001 certifications are in progress" -- both named certifications are explicitly in progress, not awarded. Supporting controls are published (EU data residency in Frankfurt, encryption in transit and at rest, no model training on customer content). Scored 1 rather than 2 because a self-asserted GDPR posture plus two pending certifications is a statement of intent, not a third-party attestation, and no auditor, scope or target date is named.

Counts Compliance certifications and Data handling, each cited below.

Does payment depend on a verified result?

Pricing is a unit-of-work model, not an outcome model: "Caddygo charges for sourcing volume, not seats. You pay per sourcing project the agents run, every plan includes unlimited users." Charging per project executed rather than per seat moves off the 0 anchor, and clears 0 on that basis alone. Payment is nonetheless owed for work the agents run regardless of whether the sourcing event produces an accepted or verified result; nothing on the page conditions payment on an outcome, and full prices are not published.

Counts Pricing model, each cited below.

Can the deployment be insured, and is the customer indemnified?

No public evidence found. The 2026-09-17 capture of caddygo.co contains no occurrence of insurance, insured, indemnity, liability, warranty, underwriting or carrier, and no guarantee, SLA or refund terms (verified by regular-expression scan over the stored document, not by reading impression). Nothing on the page offers cover, indemnity or a liability position. This is a finding about what the vendor publishes, not a gap in our research.

Counts Compliance certifications, each cited below.