Dash

Are scope, spend, and authority enforced while the agent runs?

Run-time authority is gated action by action, and the gate explicitly covers spend: "Dash asks before doing anything mutating (sending emails, posting in public channels, writing to your CRM, spending money)." Scope is additionally bounded per tool -- "Connect only the tools a job needs. You approve each connection" -- and cost is surfaced before large jobs run ("We show you the credit cost before any large job runs"). Held below 3: these are interactive human confirmations, not administrator-enforced caps. The page publishes no spend ceiling, no budget limit, no policy engine and no way to bound authority in advance of the prompt.

Our automated recount on Sep 18, 2026 counted enough evidenced fields for 1/3. It never reads what those fields say, so it does not overturn the score above, judged on Sep 18, 2026 — but where the two disagree it is a reason to read this dimension again. Why there are two scores

Counts Action space, Human oversight and Permission scopes, each cited below.

Is there a tamper-evident record of what it actually did?

Work is visible where it happens and reads are traceable to sources: "For non-mutating reads, every result is shown in thread with sources you can click." "Review logs" are named, but only as an enterprise-tier item ("Enterprise tiers available if you need SSO, review logs, or custom data controls") with no description of their contents, retention or integrity. Nothing tamper-evident or hash-chained is described, and in-thread chat history is mutable by the workspace, so this clears 0 but not 2.

Counts Explainability and Price point, each cited below.

Are compliance obligations attached per engagement?

Two certifications are published as held, not in progress: "SOC 2 Type II attested ISO/IEC 27001 Certified", repeated in the security section as "Independently verified. SOC 2 Type II and ISO/IEC 27001." Held certifications with a claim of independent verification is materially stronger than a self-asserted posture. Held below 3: the page names no auditor, no audit period, no report or Trust Center access, and offers no per-engagement schedules; the attestation is asserted on the vendor's own marketing page with nothing a buyer can pull and check.

Our automated recount on Sep 18, 2026 counted enough evidenced fields for 1/3. It never reads what those fields say, so it does not overturn the score above, judged on Sep 18, 2026 — but where the two disagree it is a reason to read this dimension again. Why there are two scores

Counts Compliance certifications and Data handling, each cited below.

Does payment depend on a verified result?

Payment is fully decoupled from result, and meters consumption directly. Pricing is a flat subscription -- "$50 per workspace per month after a $100 credit. No per-seat math, no contracts" -- on top of usage credits that "meter Dash's actual work, tool calls, model usage, sandbox runtime." Metering model usage and tool calls is the rubric's 0 anchor (paid per token regardless of result) expressed almost literally. Nothing on the page ties any part of the fee to a verified or accepted outcome, and no refund, credit-back or guarantee terms appear.

Counts Price point and Pricing model, each cited below.

Can the deployment be insured, and is the customer indemnified?

No public evidence found. The 2026-09-17 capture of dashpup.ai contains no occurrence of insurance, insured, indemnity, liability, warranty, underwriting or carrier, and no guarantee, SLA or refund terms (verified by regular-expression scan over the stored document). The page's "Security you can verify. Control you keep." section offers certifications and access controls but no financial backing for a failed or harmful agent action. This is a finding about what the vendor publishes.

Counts Compliance certifications, each cited below.