TheLibrarian.io

Are scope, spend, and authority enforced while the agent runs?

The /security page states it requests only the minimum permissions needed to provide its features - a scope limit at the authorisation boundary, enforced in practice by Google's OAuth scopes. Not 2 or 3: no runtime enforcement of spend or authority, and no customer-configurable limit, is published.

Counts Permission scopes, each cited below.

Is there a tamper-evident record of what it actually did?

No public evidence found of any record of the agent's own actions. The /security page's "strict internal controls and audit logs to monitor access" describes vendor-internal monitoring of staff access to customer data, not a reviewable record of what the agent did; the audit_trail field resting on that span was downgraded in this audit for the same reason.

Our automated recount on Oct 6, 2026 counted enough evidenced fields for 1/3. It never reads what those fields say, so it does not overturn the score above, judged on Oct 8, 2026 — but where the two disagree it is a reason to read this dimension again. Why there are two scores

Rests on Audit trail and Tamper-evident log, recorded as undisclosed and cited below. For a 0 that absence is the finding. What a score rests on

Are compliance obligations attached per engagement?

Completed Google's Cloud Application Security Assessment (CASA), a third-party audit required for applications accessing restricted Google API scopes - a real published assurance artifact. Against that, the page states SOC 2 compliance is a work in progress with certification only anticipated in 2026, so no certification is held. Scored 1.

Counts Compliance certifications, each cited below.

Does payment depend on a verified result?

No public evidence found. No pricing appears on either captured page, and outcome_based_pricing, settlement_mechanism, pricing_model and price_point are all no_public_information. Unlike an evidenced zero, nothing here establishes the payment basis in either direction.

Rests on Settlement mechanism and Outcome-based pricing, recorded as undisclosed and cited below. For a 0 that absence is the finding. What a score rests on

Can the deployment be insured, and is the customer indemnified?

No public evidence found. insurance_available, insurance_carriers, coverage_limits and indemnification are all no_public_information against the captured pages.

Rests on Insurance available, Insurance carriers, Coverage limits and Indemnification, recorded as undisclosed and cited below. For a 0 that absence is the finding. What a score rests on