Writer

Are scope, spend, and authority enforced while the agent runs?

Authorisation is enforced at run time: "Agent requests to connected systems pass through a governed execution layer that validates identity, checks permissions, and records activity," and guardrails, identity validation, granular permissions and approval flows shape agent interaction with connected systems. Centrally managed rate limits are also described. Held at 2 rather than 3 because what is enforced is authorisation (who may act), not a published limit on scope, spend or authority; the vendor's own verb is "shape", not enforce, and no spend cap or scope boundary is stated.

Counts Permission scopes and Runtime governance, each cited below.

Is there a tamper-evident record of what it actually did?

Customer-reviewable record evidenced: "audit logs surface how Writer is used across your organization", plus activity traces and performance reports for agent observability, and internal admin access "logged and periodically reviewed". Held at 2 because nothing on the page claims tamper-evidence, hash-chaining or immutability - a keyword sweep of the full 9,445-character capture for "tamper" and "immutab" returns nothing. Raises the spark-verifier v1-auto score of 1, which did not credit the customer-facing surface of the log.

Our automated recount on Sep 24, 2026 counted enough evidenced fields for 1/3. It never reads what those fields say, so it does not overturn the score above, judged on Sep 24, 2026 — but where the two disagree it is a reason to read this dimension again. Why there are two scores

Counts Explainability and Audit trail, each cited below.

Are compliance obligations attached per engagement?

Certified, and unusually so: "We undergo annual SOC 2 Type II evaluations and hold ISO/IEC 27001, 27701, and 42001 certifications" - 42001 being the AI-management standard this index rarely sees - with HIPAA Type 1 and PCI stated in the FAQ and a hedged EU AI Act commitment. Held at 2 solely because the rubric reserves 3 for per-engagement compliance schedules, and none is published; the SOC 2 report is available only on request.

Counts Compliance certifications and Regulatory alignment, each cited below.

Does payment depend on a verified result?

No public evidence found. Keyword sweep of the full trust-page capture for "outcome", "settle", "refund", "escrow", "money-back" and "guarantee" returns no hit of any kind; the page carries no payment, pricing or remedy language whatsoever. An evidenced 0, not an unchecked one.

Can the deployment be insured, and is the customer indemnified?

No public evidence found. Keyword sweep of the full trust-page capture for "insur", "indemn", "carrier", "liabilit" and "cover" returns zero hits - not even the substring traps. Note for the next run: the sweep token "sla" DOES hit this page, inside the testimonial byline "Mary Ellen Slayter". It is not an SLA. Same class as the reliability/auditory false positives logged on 09-23.