Commt

Are scope, spend, and authority enforced while the agent runs?

Enforced at run time and stated as such: "Commt checks the limit before each request, so an unexpected loop cannot consume the rest of your allowance overnight." Spend is further bounded by an organisation-wide spending cap and per-project spending caps; scope is bounded per agent ("Every agent's access to knowledge bases, tools and the internet is set by you"), with web access off-able at creation and connectors reaching only the configured service; safety guardrails are checked before the answer is returned. Not 3: every statement is vendor self-description on a single marketing capture with no third-party verification, and no enforcement of agent authority beyond connector scoping is published.

Counts Permission scopes, Runtime governance and Safety policy, each cited below.

Is there a tamper-evident record of what it actually did?

No public evidence found. The capture contains no instance of "audit", "tamper" or "hash". The vendor states the opposite of a reviewable action record: "By default, no message text is written to storage. What is kept is the metadata behind your usage report: request counts, latency, which agent answered." The entity_fields row previously filed under audit_trail rested on the single word "logs" inside a bring-your-own-keys FAQ answer and was downgraded to no_public_information in this run. HMAC request signing is listed as an Enterprise bullet, but request signing authenticates a caller; it is not a tamper-evident record of what the agent did. Absence is the finding.

Our automated recount on Sep 29, 2026 counted enough evidenced fields for 1/3. It never reads what those fields say, so it does not overturn the score above, judged on Sep 29, 2026 — but where the two disagree it is a reason to read this dimension again. Why there are two scores

Counts Data handling, each cited below.

Are compliance obligations attached per engagement?

Something published, nothing certified. The Enterprise tier lists "Custom retention and a signed DPA" and "Security review and onboarding" -- contractual undertakings available per engagement. Against that, the capture contains no instance of SOC 2, ISO 27001, HIPAA, GDPR, EU AI Act or NIST. No certification, attestation or audit report is claimed, and no named regulatory framework posture is stated; the regulatory_alignment field was downgraded to no_public_information in this run for exactly that reason. Scored 1 rather than 0 because per-engagement contractual terms are published; 3 would require certification.

Counts Deployment options, each cited below.

Does payment depend on a verified result?

Rubric 0 as written. "Commt uses fixed monthly plans with a defined number of agent requests." Payment is a monthly allowance consumed per request -- "When the allowance is used, your agents stop. No credits, no bundles, no expiring tokens" -- and is in no way conditioned on whether an agent's answer was correct or useful. Nothing in the capture ties any payment or credit to a verified outcome.

Counts Pricing model and Price point, each cited below.

Can the deployment be insured, and is the customer indemnified?

No public evidence found. The capture contains no instance of "insur", "indemnity", "indemnif" or "warrant". No carrier is named, no cover is offered to customers deploying the product, and no customer indemnity is published. Absence is the finding, not a gap in our research.