Similar-looking AI pitches may assume different data, acceptance, operating and review requirements. Ask about these differences before signing; prototype speed does not establish readiness.
1. Ask what they would refuse to build
A partner with delivery scars has a list. Ours includes autonomous agents acting on money movement without a human approval step, and any workflow whose acceptance test is subjective. If a team cannot name a single thing they would push back on, you are buying capacity, not judgement.
2. Ask to see the data model before the demo
A demonstration does not establish operating readiness. Review the domain model, entities and access boundaries alongside delivery dependencies before agreeing scope.
3. Ask where authority is enforced
For many multi-tenant systems, data-layer enforcement can reduce reliance on UI checks alone. Ask where authorization is enforced, how it is tested and what privileged exceptions exist.
4. Ask which rung of the autonomy ladder each feature sits on
- AI-assisted: the human does the job, the model removes the blank page. Usefulness, risk and review burden require evaluation.
- AI-enabled: the system drafts, routes, classifies or scores; a person approves.
- Agent-run: the agent completes a defined job inside explicit limits, with monitoring, evidence and a rollback path.
Teams that put everything on the top rung are selling ambition. Teams that place each workflow deliberately are managing risk on your behalf.
5. Ask how a bad run is detected and undone
Every autonomous step needs an answer to: what did it act on, what did it record, who is notified, and how is it reversed. If those answers do not exist, the feature belongs one rung lower until they do.
6. Ask what happens to evaluation after launch
Model behaviour drifts, prompts get edited, providers change defaults. A fixed evaluation set run on relevant changes can help reveal whether a change improved measured behaviour.
7. Ask about the compliance surface early, not late
Buyer, framework, product and scope determine applicable requirements. Confirm them with responsible reviewers early; retrofitting evidence or access boundaries may add rework.
8. Ask who operates it
Ask who will operate the system, what support is included, and what handover acceptance requires. Do not assume an operating period is included.
9. Ask what it costs when the scope is wrong
Scope can change as evidence improves. What matters is whether the contract makes correcting it a conversation or a renegotiation. Fixed scope per phase, priced before the phase starts, keeps both honest.
The short version
Buy the judgement about what not to build. The building is the commodity half of the engagement.
Further reading
Primary references for relevant design principles, not evidence of DeftSpan deployment, certification or measured outcomes. Read these in context: general safety guidance cannot remove all risks, and privacy-risk guidance is not certification.