"Customer-controlled" should be something you can check, not a label. These questions help test whether an AI-assisted monitoring system really stays under the operator's control.
Data
- Where is data stored, and who can export it?
- What is shared outside the site, with whom, and on what authorization?
Inference
- Does essential analysis run locally, or does it need an external service?
- Which model version produced a given result, and can you see it?
Identity and keys
- Can staff sign in when the internet is unavailable?
- Who owns the keys, and how are they rotated or revoked?
Licensing
- Does essential monitoring stop if a licence check cannot reach the vendor?
Support access
- How is remote support authorized, scoped and logged?
- Can it be switched off without affecting essential functions?
Updates
- How is the origin of an update verified?
- Who approves activation, and how is a failed update recovered?
GridFlex proposes these as design requirements to test with design partners. See the proposed deployment options and security approach.
