u/StunnedArtist

I’m on the IT team at a company with about 2,000 staff.

One business unit of our organization wants to build an approval app with an AI builder. Its main purpose is to hold live purchase requests. And yep, we’re testing it in real data.

I’ve been asked to write the checklist before we say yes and here’s my draft so far.

• Single sign-on, plus removing access the same day someone leaves.
• Permissions at the record level, not just the page level.
• Some kind of audit log.
• Proof of how the vendor handles security and data.
• A named person who owns the app after launch.

My question is...which of these are true deal breakers? And also, which ones can we cover process instead?

I also don't want IT stuck maintaining generated code that nobody documented.

If you've been through this, what did your checklist look like?