A practical checklist for procurement and engineering teams before client code, data, or operational access enters an engagement.
A technical engagement should have a defined question, named owners, documented access boundaries, and outputs that support a decision.
Written scope and acceptance criteria
Evidence and assumption tracking
Authorized access and approved tools
Named decision owners
Explicit deliverables and exclusions
A readout before the next commitment
These are controls and questions to resolve during due diligence and kickoff. The signed agreement governs the engagement. This page is not a substitute for client security review, contractual terms, or applicable legal advice.
Agree confidentiality terms, permitted use, background IP, deliverable ownership, and any publication rights in the contract. Public case studies require separate authorization; do not send proprietary material during an initial booking.
Name the authorized systems, environments, people, and access window. Prefer read-only and least-privilege access when sufficient; agree credential handling, access revocation, and whether any production interaction is permitted.
Document data categories, approved storage locations, transfer channels, retention periods, and deletion requirements. Minimize or redact sensitive samples where possible. Confirm what evidence of deletion is required and what legal retention obligations apply.
Agree the approved providers, permissible inputs, hosting boundaries, and human-review requirements. Verify training use and retention settings for the specific product and contract. Zero retention is not assumed across all services or configurations.
Set named incident contacts, escalation channels, change approvals, validation gates, and rollback responsibilities. Confirm the handover inventory, runbooks, access revocation, and obligations that continue after delivery.
Assign responsibility for hardware access, test supervision, emergency stops, safety qualification, and release authorization. Simulation success is not physical safety certification. Each domain has its own policy artifacts and evaluation gates.
No SOC 2 certification, insurance limit, universal zero-retention guarantee, or third-party endorsement is asserted here. Required evidence and any gaps should be resolved before access is granted.
Discuss the system question and the information available. Scope, fee, timing, and contractual terms are agreed before kickoff.
