KeywordsAI

Are scope, spend, and authority enforced while the agent runs?

Vendor states budgets and rate limits can be set per key, per customer or org-wide, with warnings as they are approached and requests blocked before spend runs over. Blocking is enforcement at run time, not merely reporting, so this clears 1. Not 3: the enforced limit covers spend and request rate only - no scope or authority limit on what the observed agent may do is published on the page checked.

Is there a tamper-evident record of what it actually did?

Every LLM call, tool run, retrieval and agent turn becomes a span in one trace, with model, latency, cost, tokens and the exact input and output on every span - a customer-reviewable record claimed at product level. Not 3: nothing on the page claims the record is tamper-evident, hash-chained or append-only. audit_trail_immutable is recorded as no_public_information, and the capture contains no tamper-evidence vocabulary at all.

Our automated recount on Aug 14, 2026 counted enough evidenced fields for 1/3. It never reads what those fields say, so it does not overturn the score above, judged on Aug 17, 2026 — but where the two disagree it is a reason to read this dimension again. Why there are two scores

Are compliance obligations attached per engagement?

ISO 27001, SOC 2, GDPR and HIPAA with a BAA available are named in a certifications block on the vendor homepage. All are self-declared: no SOC 2 Type, no report, no auditor, no certificate date and no per-engagement compliance schedule is published on the page checked. Named frameworks without published evidence of certification is a 1.

Our automated recount on Aug 28, 2026 counted enough evidenced fields for 2/3. It never reads what those fields say, so it does not overturn the score above, judged on Aug 17, 2026 — but where the two disagree it is a reason to read this dimension again. Why there are two scores

Does payment depend on a verified result?

No public evidence found. Pricing is stated only as "Start for free"; outcome_based_pricing and settlement_mechanism are both recorded as no_public_information, and the capture contains no escrow, milestone-release or clawback vocabulary. Payment is not tied to a verified result, which is the rubric's definition of 0.

Can the deployment be insured, and is the customer indemnified?

No public evidence found. The vendor homepage is the only document captured for this entity and contains no occurrence of "insur", "indemn" or "liabilit" - no cover, no named carrier, no published limit and no customer indemnity. Recorded as a finding, not a gap.