Security and data-handling boundaries
Security requires inspectable controls. Before deployment, document data categories, processing locations, permissions, retention, and responsibilities, then test the system against the agreed scope.
Identity and source access
Source permissions must be enforced during retrieval, rather than only hiding documents in the interface. Evaluation includes attempts to access another department’s documents and tests of user and customer isolation, alongside authentication and roles.
Retention, updates, and support
The agreement defines conversation, log, and backup retention, deletion, and export. It also defines support access, update and incident handling, and restoration testing.
Model limitations
Models can make errors or produce unsupported answers. Define evaluation criteria, reviewable sources, and clear usage boundaries. Sensitive decisions need appropriate human review; the model is not treated as the sole source of truth.
Organizational review
Government and regulated-organization requirements vary with data and deployment. Approvals, certifications, and contractual requirements must be verified for the specific project. This page does not claim government approval or security certification.