Stripe

Are scope, spend, and authority enforced while the agent runs?

"you can assign different detailed roles to enable least-privilege access for your employees, and create restricted API keys" - restricted API keys are a scope limit actually enforced at call time, not merely a described intent. Falls short of 3 because no spend ceiling or authority limit on agent-initiated actions is published on the pages checked. The runtime_governance field previously filed here quoted "Actions within the most sensitive areas of the infrastructure need a human review", which describes Stripe's own internal change management, not a control the customer's agent runs under; it was rejected in this audit.

Is there a tamper-evident record of what it actually did?

"You can also view audit logs of important account changes and activity in your security history" evidences a customer-reviewable record of account activity. Falls short of 3: the only immutability claim on the page ("Code changes are recorded in an immutable, tamper-evident log") is about Stripe's internal code deployment pipeline, not this record, and the field asserting otherwise was rejected in this audit.

This score counts Tamper-evident log as undisclosed, and that absence is flagged for review — the cited source may address it. If so, this score is too low. How we check absences

Are compliance obligations attached per engagement?

"certified us to PCI Service Provider Level 1" is a named certification from a named regime, and the DPA binds Stripe to comply with data protection law when processing personal data. Falls short of 3: PCI DSS is a payments-security regime, not an AI assurance schedule, and no per-engagement compliance schedule or AI framework posture is published.

Does payment depend on a verified result?

No public evidence found. "Integrated per-transaction pricing with no hidden fees" charges per transaction processed, which is a usage fee, not payment released on a verified outcome of agent work.

Can the deployment be insured, and is the customer indemnified?

No public evidence found. Neither the security page nor the DPA checked names cover, a carrier, a policy limit, or a customer indemnity for AI or agent-caused loss.