Ask how the work happens. Then inspect the evidence.

The five

Ask them in this order. The order does work.

Identity first, because everything else is measured against it. Then what the model holds, then who says it worked, then what happens when it does not, then who is named on it.

1. “When the AI does something, what account does it use?”

   A good answer names an identity and a duration in the same breath: a grant that was minted for this operation on this target and expires on a clock. A dodge reaches for adjacent virtues — the agent is secure, the traffic is encrypted, the actions are logged. All of that can be true while a permanent administrator sits underneath it, and if one does, it is the ceiling on everything else you are shown.

   FOLLOW-UP · “Does that account exist right now, and can it do that on every machine?” — see Just-in-Time Elevation

2. “Does the model ever see the password?”

   A good answer is a boundary description: the model gets a reference it cannot resolve, something else resolves it, and the connection is authenticated before any generated script exists. A dodge is about hygiene after the fact — secrets are redacted from logs, masked in the transcript, scrubbed from telemetry. Every one of those describes cleaning up a value that has already been somewhere it should not have been.

   FOLLOW-UP · “So could I recover the plaintext out of your prompt history?” — see Credential Vault

3. “Who told you it worked?”

   A good answer points at the machine: after the change, an independent check ran on the target and its answer is the field in the record — so a failure writes itself in whether or not anyone would have chosen to report it. A dodge points at the screen. The status went green, the job returned zero, the assistant summarised the outcome. Ask them to break the fix again on the call and re-open the same record; a platform that only reports success has nothing to show you at that moment.

   FOLLOW-UP · “Which line here came from the target, and which line came from you?” — see Outcome Receipts

4. “Show me the undo — before you run it.”

   This one is a request rather than a question, and that is deliberate. A good answer puts the reversal on screen before the change happens, because it is part of the procedure and a condition of the procedure being allowed to run at all. A dodge produces the undo afterwards, or produces a backup. A reversal written after the fact is a report about what happened; it was not a plan, and nobody committed to it in advance.

   FOLLOW-UP · “Run it, then undo it, on this call.” — see Automation & Runbooks

5. “Whose name is on this, and is it in the same record as the work?”

   A good answer is one reference number that resolves to the person who authorized it, the privilege it used, the job that ran, and the machine's reply. A dodge is two systems: approval lives in the ticket, execution lives in the automation platform, and they are correlated by timestamp. That is two stories that agree, which is a fine operational practice and is not a chain of custody. And if the honest answer is that nobody's name is on it, you have found the thing your insurer is going to ask about.

   FOLLOW-UP · “Give me one number I can quote back to you next quarter.” — see Commanded Autonomy

Grading what you get back

Three kinds of answer. Only one of them leaves the building with you.

After the call you have to convince someone who was not on it — a partner, a client, an underwriter, an internal auditor. That is the real test of an answer, and most answers fail it for a reason nobody notices during the demo.

Two instruments, two moments

This page is the ammunition. The spec is the standard.

One caution about using these against us. We answer all five the way this page says a good answer sounds, which is not evidence — it is what you would expect a page we wrote to say. Where the categories actually differ is a more useful read, and the fastest resolution is to make us run an operation while you watch and then ask for the export.