Start with permissions, not features
The first question for any vendor is not “what can it do” but “what is it allowed to do, and by whom.” Does the assistant enforce the same permissions as the applications, or get broader access for convenience? In [prompt.exc], isolation and role-based access are enforced identically in chat and in the app.
Ask what happens before an action runs
For anything consequential — spend, access, leave, a contract handoff — does the platform act automatically, or hold for a human decision? In [prompt.exc], approvals are held, never assumed.
Ask about rollout order
Does the vendor configure roles, policies and access before real workflows go live, or after? Our implementation guide sets out the order we follow — roles and policy first, then integrations, then real workflows.
Ask what you get if you leave
Is your data isolated in a way that makes export straightforward? That should be a contractual answer, which is why we confirm export and retention terms per contract.
Related