An independent challenge of whether the evidence actually substantiates the authority, approvals and controls claimed for your AI agents and AI-enabled systems.
Most AI governance reviews ask whether the right policies exist. This engagement asks a harder question: does the evidence support what the organisation says its AI can do, may do, and is prevented from doing? Claims are tested against documents and, where agreed, against the records you supply.
The result is a firm, written analytical assessment with clearly bounded scope. Every conclusion is tied to its evidence, every gap is named, and every limitation is stated — so that leaders, boards and technical teams can act on what is established rather than on what is assumed.
What are our AI agents actually authorised to do, and under whose authority do they act?
Where a human approval is claimed, does the evidence show it is required, configurable or merely procedural?
Do the records we hold reconcile with the approvals and controls we describe to boards, auditors and customers?
Where do agents, platforms and suppliers combine to create authority no single document describes?
Which claims rest on evidence, which rest on assumption, and what would it take to verify them?
The level of review is agreed in writing before work begins, and the report states which applies to each conclusion.
Policies, governance documents, vendor documentation and published platform material are examined to establish what authority, approvals and controls are stated, and whether those statements are consistent with one another. Conclusions are limited to what the documents say.
Where agreed in writing, selected records you supply — such as approval logs, permission exports or configuration extracts — are compared against the documented position. Records are analysed as supplied; their authenticity and completeness are not independently established, and this is stated in the report.
A concise, plain-English account for leaders: what is substantiated, what is not, and which decisions or disclosures depend on the difference.
Who and what each AI agent or feature acts on behalf of — user permissions, service accounts, application identities — and how that authority is granted, limited or inherited.
Where agreed records permit, a comparison of claimed human approvals and execution controls with what the supplied records show.
Where agents, platforms, integrations and suppliers combine, and where authority or reliance accumulates across them.
Each material claim graded by source, date and strength of evidence, with what remains uncertain stated plainly.
The questions your technical teams or specialists should resolve first, ordered by consequence. It does not prescribe implementation.
Specific evidence that would close each open question, and the criteria by which it could be judged sufficient.
A separately commissioned follow-up review against the same criteria, once further evidence is available.
Independent authentication of client records, logs or exports
Validation of real-world automated execution traces
Live system access, monitoring or enforcement of controls
Audit opinions, certification or compliance attestation
Guarantees of AI safety or correct system behaviour
Vendor selection, implementation or management decisions
Published research on the SoftTech AI Registry remains independent. Commissioning this engagement does not influence Registry content, and Registry entries are used only as one documentary source among others.
Please do not send confidential evidence, credentials or system exports in a first email. Evidence is requested only after scope has been agreed, through a channel agreed with you.
Every commissioned engagement includes:
A defined, written scope
A stated research cut-off date
Documented sources
Stated evidence limitations
Agreed deliverables
Commissioned work does not provide certification, endorsement, privileged vendor access, penetration testing or continuous monitoring. Research into documented vendor capabilities is separate from examining an organisation's own implementation. Any review of client-supplied configuration evidence must be explicitly agreed and its verification limitations stated.
Paying for research cannot buy favourable findings or changes to published research conclusions. Commissioned reports are treated as confidential under the agreed engagement terms. Published research remains independent of commercial engagements.
Engagements are individually scoped and quoted. Fees are agreed before work begins.
Email a short, non-confidential description of the AI systems involved and the claims or decisions you need examined. Scope, evidence availability and the level of review are agreed before any work begins.
Please include your organisation, the service of interest, the software platforms involved and a brief description of what you need to understand. Do not send passwords, credentials, system diagrams or sensitive technical evidence; evidence is requested only after scoping, through a channel agreed with you.