Data boundaries
What can leave the workspace, and how long should it remain?
Questions before a pilot
Data, access and evidence.
Access ownership
Who connects accounts, approves work and revokes access?
Operational review
How should failures, deletion and provider changes be handled?
Evidence before assurance.
SSO, private deployment, audit coverage and retention controls need validation. No certification or compliance assurance is claimed.