Review current client facts
Client facts
Loading- 01
- OrganizationNorthstar Support
- 02
- MaturitySeries A / scaling
- 03
- MandateCustomer-facing copilots
- 04
- Timeframe2-week sprint
- 05
- Risk areas3 selected
- 06
- EngagementGovernance + Eval Buildout
Decision posture
Critical
Customer-facing copilots is not launch-ready. Treat this as a control-build engagement before any expansion, with executive sign-off and evidence review before release.
Drafts stay in this browser. Scope rules run locally with no AI or background API call.
02Risk assessment
Mark the exposures that require evidence.
Select only the risks the engagement must investigate. Each selection adds a named artifact, control, discovery question, and visible weight to the recommendation.
A
Risk matrix
Selected rows become binding inputs to the live scope document.
| Include | Exposure | Severity | Evidence artifact | Control direction |
|---|---|---|---|---|
Accuracy drift Quality | 3/5 Moderate | Golden-task evaluation pack with acceptance thresholds. | Require golden tasks, reviewer sampling, drift thresholds, and launch-blocking eval gates. | |
Privacy / data retention Data | 4/5 High | Data handling review covering retention, redaction, and vendor boundaries. | Map prohibited data, retention limits, redaction ownership, and vendor logging boundaries. | |
Security / prompt injection Security | 4/5 High | Abuse-case test plan for prompt injection, tool misuse, and exfiltration paths. | Run prompt-injection abuse cases against tools, retrieval, permissions, and export paths. | |
Regulatory exposure Compliance | 5/5 Critical | Regulatory control map with sign-off owners and evidence requirements. | Name compliance owners, decision rights, evidence artifacts, and external review triggers. | |
Evaluation gaps Evidence | 3/5 Moderate | Measurement plan for offline evals, review sampling, and production monitors. | Define offline eval coverage, production monitors, sample rates, and failure triage SLAs. | |
Model / vendor lock-in Commercial | 2/5 Watch | Vendor portability memo with model fallback and cost-control options. | Document fallback models, switching costs, data portability, and degradation modes. |
B
Decision ledger
The recommendation is a fixed sum, shown here in full.
Company stage3Series A / scaling
Use case4Customer-facing copilots
Timeline22-week sprint
Stack signal1Evidence named
Selected risks103 areas
Total posture score20Critical
Recommended posture
Critical
Customer-facing copilots is not launch-ready. Treat this as a control-build engagement before any expansion, with executive sign-off and evidence review before release.