Pally

Are scope, spend, and authority enforced while the agent runs?

Three concrete run-time limits are described on the vendor own homepage (capture 20592, retrieved 2026-10-06). Spend is bounded by a single-use virtual card capped at exactly the amount the user approved, anything leaving the user own world (an outbound message, a purchase, a calendar invite) is shown word-for-word and executes only after explicit approval, and content originating outside the user connected accounts is treated as information to read rather than instructions to act on. Scope is user-controlled per connected app. Not scored 3 because every one of these limits is self-attested and the entity publishes no audit record at all (audit_trail and audit_trail_immutable are both no_public_information on the same capture), so a customer has no way to verify that any limit actually held at run time.

Counts Human oversight, Action space, Runtime governance and Permission scopes, each cited below.

Is there a tamper-evident record of what it actually did?

No public evidence found. The capture of pally.com checked for this entity describes no run log, no export, and no customer-reviewable record of what the assistant did. audit_trail and audit_trail_immutable are both recorded as no_public_information against that capture, which is a finding about a page that was read, not an unexamined gap.

Rests on Audit trail and Tamper-evident log, recorded as undisclosed and cited below. For a 0 that absence is the finding. What a score rests on

Are compliance obligations attached per engagement?

No public evidence found. The capture names no certification, no audit, no auditor and no regulatory framework the product is aligned to. compliance_certs and regulatory_alignment are both no_public_information against the page checked.

Rests on Compliance certifications and Regulatory alignment, recorded as undisclosed and cited below. For a 0 that absence is the finding. What a score rests on

Does payment depend on a verified result?

Payment is a tiered subscription with a monthly usage allowance per tier, charged whether or not the assistant completes the task it was asked to do. This is the rubric 0 condition, payment regardless of result. outcome_based_pricing and settlement_mechanism are both no_public_information on the capture checked, so nothing on the page releases payment against a verified outcome.

Rests on Pricing model and Price point, each cited below. Also named Outcome-based pricing and Settlement mechanism, which our record now shows as undisclosed; that part of the support no longer holds. What a score rests on

Can the deployment be insured, and is the customer indemnified?

No public evidence found. The capture carries no insurance, no named carrier, no published limit, no customer indemnity and no liability cap. All six assurance fields (insurance_available, insurance_carriers, coverage_limits, indemnification, liability_cap, own_liability_cover) are no_public_information against the page checked.

Rests on Own liability cover, Coverage limits, Indemnification, Insurance available, Insurance carriers and Liability cap, recorded as undisclosed and cited below. For a 0 that absence is the finding. What a score rests on