elan1 Library · 03
An RFP question set for AI agents that write
Forty-six questions to put to any vendor, including us, whose AI agents will change your records. Each says why to ask it, what a good answer contains, and how we answer it today.
This RFP question set helps buyers assess any AI agent that writes to business systems, not only elan1. It asks who or what may write, how approvals work, what is recorded for every action, whether refusals are recorded, and how the buyer or an auditor can check the evidence without the vendor's help.
Everything this paper describes is available in elan1 Govern, Work, Decide and Run. Each capability carries its assurance level. Every record, identifier and value shown is an illustrative specimen, not customer data.
Abstract
Most AI procurement questionnaires ask about models, data use and uptime. Few ask what happens at the moment an agent changes a record. This question set fills that gap. It is vendor-neutral by design: it does not assume elan1, and a vendor can answer it well without us.
Questions are grouped by the moment they test — before the write, at the write, after the write and when something fails — and each one comes with the evidence a good answer should point to.
1. How to use this question set
This is a set of forty-six questions to put to any vendor whose AI agents will change your records: ledgers, invoices, claims, customer files. It is vendor-neutral by design. It does not assume elan1, and a vendor can answer every question well without us. It is free to reuse in your own requests for proposal, with or without attribution.
The questions are grouped in nine sets that follow the life of a single write: who may ask for it, what decides it, what is left behind, and what happens when something fails or you want to leave. Figure 1 places the nine groups on those four moments.
Figure 1
Nine question groups on the four moments of a write
Ask for three tags on every answer
Ask each vendor to tag every answer with the assurance level from which it is true, the mode it applies in (does the vendor hold the write credential, or only observe), and its status: available and in use, on the vendor’s roadmap, or dependent on an event. An answer without those three tags is a description of intent.
How each entry is laid out
- The question, numbered Q01–Q46 so answers can be cross-referenced.
- Why ask it: the risk the question tests.
- What a good answer contains: the evidence to look for, from any vendor.
- How elan1 answers: our own answer in one line, with its level, mode and status. We include it so you can hold us to the same bar.
2. The write path and the allow
Start with the write itself. These questions establish which agents can change which records, through how many routes, and what produces the decision to allow. They cover inventory and credentials, the first area most questionnaires skip.
Q01Which of your agents can change a record in our systems, and with what credential?
- Why ask it
- Most of the risk sits in standing credentials handed to agents, not in the model.
- What a good answer contains
- An inventory of write-capable agents per target system, who holds each credential, its scope and its lifetime.
- How elan1 answers
- In Mode A, agents hold no write credential. One single writer holds a 10-minute, single-use credential. AvailableL1 · Mode A
Q02Is there one route every consequential write must take, or several?
- Why ask it
- Controls on one route are worth little if a second route exists.
- What a good answer contains
- The route named, and a bypass attempt against the real target that failed, with its evidence.
- How elan1 answers
- One route: the Right Path, rung 0b STOP to rung 9 METERED. Conformance test C2 tries every other path against the real target. AvailableL1 · Mode A
Q03Can a model produce the decision to allow a write?
- Why ask it
- An allow produced by a model cannot be replayed or explained to an auditor.
- What a good answer contains
- Allows come from versioned rules evaluated without a model, and a dependency check proves no model client is reachable.
- How elan1 answers
- No. A model may produce a write intent, never an allow. Rungs 3–8 cannot reach a model client; CI checks the import graph (C1). AvailableL1 · Mode A and B
Q04Is every write typed and declared, or can an agent issue a generic write?
- Why ask it
- A generic "execute" permission makes every other control unenforceable.
- What a good answer contains
- Explicit write types at an explicit rule version, and no catch-all scope.
- How elan1 answers
- Rung 2 WRITE DOOR: the write type must be on the declaration's list, at an explicit version. There is no generic write. AvailableL1 · Mode A and B
Q05Which checks run before a write, and which can never be skipped?
- Why ask it
- Optional checks get switched off under deadline pressure.
- What a good answer contains
- A named list of pre-write checks run against your own data, with the mandatory ones identified.
- How elan1 answers
- Nine pre-gates, G1–G9, at rung 3. Six can never be skipped: consent, residency, retention, dual control, counterparty and precondition. AvailableL1 · Mode A and B
Q06What happens if the same write intent is submitted twice?
- Why ask it
- Retries are normal; duplicate postings and double charges are not.
- What a good answer contains
- Idempotency by intent: the original outcome is returned and nothing is written or billed twice.
- How elan1 answers
- A replay returns the original outcome, sequence and digest, with no second meter event (C7). AvailableL1 · Mode A and B
Q07How is a committed write reversed?
- Why ask it
- Every system of record needs a way back that is itself controlled.
- What a good answer contains
- A reversal plan per write type, the method it uses, and a drill that proves it runs.
- How elan1 answers
- Each reversal plan runs by both paths, native undo and a compensating entry; drill C12 tests both. AvailableL1 · Mode A
3. Approvals and autonomy
A human approval is only a control if the approver is named, separate from the requester, shown the change, and cannot be skipped by a timeout. Autonomy is the other side of the same question: how much an agent may do before a person must say yes.
Q08Who approves a write, and can the requester approve their own?
- Why ask it
- Self-approval, by a person or an agent, is the oldest control failure there is.
- What a good answer contains
- A named approver per rule, separation from the requester checked by the system, and no approvals by agent tokens.
- How elan1 answers
- A named approver holds the write at rung 6 where your policy asks. No approval by the requester, none by an agent token (C11). AvailableL1 · Mode A and B
Q09What does the approver see before deciding?
- Why ask it
- An approval given without the difference in front of the approver is a signature, not a review.
- What a good answer contains
- The proposed change against the current record, the checks it passed, and the rule that requires the approval.
- How elan1 answers
- The approver sees the difference, the gates and the policy, then decides. The decision is sealed in the record. AvailableL1 · Mode A and B
Q10How is autonomy granted, and what happens to an agent with no grant?
- Why ask it
- Defaults decide what an unconfigured agent can do on its first day.
- What a good answer contains
- Explicit autonomy levels, a deterministic way to earn them, a lowest-level default, and the level recorded per write.
- How elan1 answers
- Levels A0–A5; a missing grant resolves to A0 Observe (C6). The level a write ran at is sealed in F11 autonomy_level. AvailableL1 · Mode A and B
Q11What happens when nobody answers an approval request?
- Why ask it
- A timeout that defaults to "allow" quietly removes the approver.
- What a good answer contains
- Expiry results in refusal, and the refusal is recorded like any other outcome.
- How elan1 answers
- Expiry means refusal. The refusal writes a proof record and is metered at 0.4 of a governed action. AvailableL1 · Mode A and B
Q12How do we stop every agent write at once?
- Why ask it
- Incidents need one switch, checked before anything else, not a list of keys to revoke.
- What a good answer contains
- A tenant-wide stop read first on every write, itself recorded, with a documented way to resume.
- How elan1 answers
- Rung 0b STOP is read first on every write. A tenant stop during an incident is made through elan1 Govern. AvailableL1 · Mode A
4. Evidence and records
After the write, what remains is the record. Ask for one record per attempt, a published schema, a check your own team can run, and an honest account of what that check proves. Q15 and Q16 separate tamper evidence, which you can check with the vendor’s help, from verification that needs no vendor at all.
Q13Does every consequential write, allowed or refused, leave one record?
- Why ask it
- Refusals are evidence that the controls work; a log of successes alone proves little.
- What a good answer contains
- One record per attempt with the same shape for commits and refusals, linked to the write it describes.
- How elan1 answers
- Yes: a 16-field proof record (Seal v6) for every commit and every refusal. AvailableL1 · Mode A and B
Q14What does the record contain, field by field?
- Why ask it
- You cannot rely on a record whose schema you have not seen.
- What a good answer contains
- A published schema: who acted, what changed, under which rules and version, at what autonomy, and when, with the time zone.
- How elan1 answers
- Sixteen named fields, F01 tenant_id to F16 recorded_at, published on the proof-record page with a specimen. AvailableL1 · Mode A and B
Q15How would we detect that a record was altered, reordered or removed?
- Why ask it
- Tamper evidence is only useful if your own team can run the check.
- What a good answer contains
- A hash chain you can walk yourself, the exact checks it supports, and a plain statement of what it does not prove.
- How elan1 answers
- Tamper-evident to you: each record is hash-chained to the one before. C9 finds a flipped octet, a reordered pair, a duplicate and a gap. Not signed at L1. AvailableL1 · Mode A and B
Q16Can we verify the evidence without your systems or network?
- Why ask it
- Evidence that only the vendor can check is the vendor's word.
- What a good answer contains
- Signatures, independent timestamps and an offline verifier, with an honest statement of when each exists.
- How elan1 answers
- Not at L1: verification needs elan1. From L2: Ed25519 signatures per residency domain, two RFC 3161 timestamp authorities and a free offline verifier. AvailableL2 · Mode A and B
Q17Can we hand the evidence to an auditor without giving them system access?
- Why ask it
- Audit access to production is a risk of its own.
- What a good answer contains
- A self-contained, documented evidence package and a read-only route for checks.
- How elan1 answers
- At L1, checks run through the verify call with a read-only token. From L2, an eight-member evidence bundle. AvailableL1 and L2
Q18Can anyone, including your operators, update or delete evidence rows?
- Why ask it
- Administrative edit rights undo tamper evidence from the inside.
- What a good answer contains
- Append-only storage set by database permissions, with no update or delete path, and how that is tested.
- How elan1 answers
- No UPDATE or DELETE on evidence rows; records are only ever appended. AvailableL1 · Mode A and B
Q19Where does the evidence physically live?
- Why ask it
- Location drives residency, retention, access and exit.
- What a good answer contains
- The store, the region, who operates it and who can read it.
- How elan1 answers
- Hosted: inside residency domain "in". In your own VPC or on premises: in your environment. AvailableL1
5. Assurance levels and modes
Two words carry most of the risk in a proposal: “enforced” and “verified”. These questions make the vendor say where each word applies. A vendor that does not hold the write credential can evaluate and record a write; it cannot stop one.
Q20For each claim in your proposal, at what level and in which mode is it true, and is it shipped?
- Why ask it
- Proposals mix shipped features, designs and plans in the same tense.
- What a good answer contains
- A claims register: each claim with its level, mode and status, and a change log.
- How elan1 answers
- Every public claim sits in a versioned register with its level, mode and status: available, on auditor acceptance, or not covered. AvailableAll levels
Q21Where exactly do you say "enforced", and where only "recorded"?
- Why ask it
- A vendor that cannot hold the credential cannot stop the write; it can only observe it.
- What a good answer contains
- A clear line between paths where the vendor holds the write credential and paths where it advises.
- How elan1 answers
- "Enforced" only in Mode A, where the kernel holds the single write credential. Mode B: evaluated against your rules and recorded. AvailableL1 · Mode A / Mode B
Q22How do third-party agents connect, and what may they claim about your product?
- Why ask it
- Partners overstate integrations; the buyer inherits the overstatement.
- What a good answer contains
- Named connection modes and a published conformance bar a partner must pass before claiming anything.
- How elan1 answers
- Third-party agents connect in Mode B, or Mode A by agreement. None may claim to run on elan1 Govern before conformance tests C1–C14 pass. AvailableL1 · Mode A and B
Q23Has an independent auditor accepted your evidence, and what would it take?
- Why ask it
- The strongest assurance claim needs a third party, not a roadmap.
- What a good answer contains
- An honest yes or no, and the event, not the date, that would change the answer.
- How elan1 answers
- No. L3 Proven starts only when an outside auditor accepts an L2 bundle in writing. It applies on auditor acceptance and carries no date. On auditor acceptanceL3
Q24Which words do you refuse to use about your own product?
- Why ask it
- A vendor's banned-word list tells you how it will describe itself to your regulator.
- What a good answer contains
- A published list, applied to marketing, documentation and contracts alike.
- How elan1 answers
- The claims register publishes the words we never use, such as any that promise more than tamper evidence or imply a certification. They fail our copy check before anything is published. AvailableAll pages
6. Residency and data protection
Evidence is kept for years, often longer than the data it describes. Ask where it lives, who holds the keys, whether personal data enters it, and how erasure works against a store built never to change. Our own position on erasure is set out in full in the library note DPDP and the append-only chain.
Q25Where are data and evidence processed and stored, and can they cross regions?
- Why ask it
- Residency promised in a contract must hold in the architecture.
- What a good answer contains
- Named regions, zones and stores, and how a cross-region read is prevented rather than merely discouraged.
- How elan1 answers
- Residency domain "in": AWS ap-south-1 (Mumbai), three zones. A cross-domain query is impossible by design. New regions open on a signed contract, never a forecast. AvailableL1 · Mode A and B
Q26How are signing and encryption keys held: per tenant, per region, or shared?
- Why ask it
- Key scope sets the blast radius of a compromise and the shape of an exit.
- What a good answer contains
- The key model, custody, rotation, and what is still undecided.
- How elan1 answers
- One signing key per residency domain. Public keys travel in every evidence bundle; private key material never does. AvailableL2
Q27Does personal data enter the evidence store?
- Why ask it
- Evidence kept for years is the hardest place to remove personal data from.
- What a good answer contains
- Which fields could hold personal data, and how payloads are kept out.
- How elan1 answers
- The record holds F14 payload_hash, a hash of the payload, not the payload. The salting choice for that hash is under evaluation and will be published on Disclosures. AvailableL1 · Mode A and B
Q28How does erasure work against an append-only evidence store?
- Why ask it
- Erasure rights and tamper evidence pull in different directions; a vendor should say how they meet.
- What a good answer contains
- The mechanism, the legal view it rests on, and what is still open.
- How elan1 answers
- Erasure is itself a governed write, and the chain keeps only hashes. Whether a hash is personal data in your deployment is for your counsel; elan1 makes no claim beyond this. OpenL1
Q29Who are your subprocessors, and how will we hear of a new one?
- Why ask it
- Subprocessors move your data outside the contract you signed.
- What a good answer contains
- A current list and a notice-before-change commitment.
- How elan1 answers
- AWS ap-south-1 is named on the Security page. Any addition is logged there first. AvailableNo level
Q30What is your role under data protection law in our deployment?
- Why ask it
- Fiduciary or processor changes who answers to the data principal and the regulator.
- What a good answer contains
- A role per deployment model, confirmed by counsel and reflected in the contract.
- How elan1 answers
- Hosted: you are the Data Fiduciary and elan1 your Data Processor, under a data processing agreement. Your own VPC or on premises: neither, except support access you grant, where elan1 is Processor. AvailableNo level
7. Runtime and contracts
The write path depends on a runtime: gateways, model serving, retrieval, workflow engines, tool registries. Ask what each component is, whether it can be replaced, how a replacement is proven, and which way the system fails when a component is down.
Q31What does the agent runtime depend on, and can each component be replaced?
- Why ask it
- A runtime built on one supplier's components inherits that supplier's risk.
- What a good answer contains
- A component list behind stable contracts, with at least two implementations per contract.
- How elan1 answers
- elan1 Run: ten versioned fusion.*/v1 contracts, each with two licence-clean implementations. AvailableNo level · elan1 Run
Q32How do you prove a replacement component behaves like the one it replaces?
- Why ask it
- Swaps break behaviour silently unless a suite says otherwise.
- What a good answer contains
- A blocking conformance suite you can run yourself, offline.
- How elan1 answers
- Conformance suite K1–K7, blocking-green and offline, including on your auditor's machine. A component that fails does not replace the one in service. AvailableNo level · elan1 Run
Q33What happens to writes when a dependency fails?
- Why ask it
- The failure direction is a design choice, and most products choose availability.
- What a good answer contains
- A failure matrix per dependency, showing every outage ends in refusal, not allow.
- How elan1 answers
- If the runtime fails, writes stop. If elan1 Govern fails, allows stop. The C5 matrix checks every dependency outage produces a refusal. AvailableL1 · Mode A
Q34How are model spend and tool use controlled before they happen?
- Why ask it
- Budgets checked after the call are reports, not controls.
- What a good answer contains
- Budgets that stop before the first token, and a tool registry pinned by hash, with scopes.
- How elan1 answers
- Gateway budgets stop before the first token; tools are registered, pinned by hash, with scopes and autonomy ceilings. AvailableNo level · elan1 Run
8. Pricing and metering
Pricing shapes behaviour. A vendor paid per approval has a reason to approve; one paid for refusals has a reason to refuse. Ask what the unit is, how it reconciles to the record, and what is never charged. elan1's list prices are on the pricing page; every figure there is exclusive of GST.
Q35What is the billable unit, and can every invoice line be traced to an event?
- Why ask it
- An unreconcilable invoice is an unauditable one.
- What a good answer contains
- One meter unit, a key on every invoice line, and a reconciliation between meter, record and target.
- How elan1 answers
- The governed action. An invoice line without a write_id cannot exist; C10 reconciles meter event, proof record and target both ways. AvailableL1 · Mode A and B
Q36Do you charge for refusals, retries or failed attempts?
- Why ask it
- A refusal priced like an allowed write rewards the vendor for saying no; one priced above it rewards loose rules.
- What a good answer contains
- A published refusal rate below the allowed rate, and replays at zero, by rule, not by credit note.
- How elan1 answers
- A refusal is metered at 0.4 of a governed action (₹0.64 at L1 beyond the allowance), always less than an allowed write; replays add no meter event. AvailableL1 · Mode A and B
Q37Are there per-seat, per-agent or outcome-based charges?
- Why ask it
- Seats penalise wide approval; outcome fees reward approvals.
- What a good answer contains
- A price that does not change with who approves or what the decision was.
- How elan1 answers
- No per-seat price and no outcome pricing. A yearly floor per tenant set by assurance level, with an action allowance. Prices exclusive of GST. AvailableNo level
Q38Are prices published, and how are changes notified?
- Why ask it
- Unpublished prices make comparison and budgeting guesswork.
- What a good answer contains
- A public price book with its status, and a versioned change history.
- How elan1 answers
- Published on the pricing page as current list prices, exclusive of GST. AvailableNo level
9. Vendor viability and exit
Agents that write create records you will need long after the contract ends. Ask what is real today, what survives the vendor, and whether you can leave without asking permission.
Q39Who are your production customers, and which certifications do you hold?
- Why ask it
- References and certificates are evidence; claims about them are not.
- What a good answer contains
- Named, contactable references and certificates with scope and date, or a plain "none".
- How elan1 answers
- We name a customer only with its written consent, and none is named on this site. elan1 holds no security or AI certifications today. AvailableNo level
Q40What is available today, and what is still on the roadmap?
- Why ask it
- Buying a roadmap is a different contract from buying a product.
- What a good answer contains
- A status per capability and a list of future improvements in order, with changes logged.
- How elan1 answers
- elan1 Govern, Work, Decide and Run are available, with L1 Guarded and L2 Attested. Future improvements are listed in order, without dates. AvailableAll levels
Q41If you stop trading, can we still verify our evidence?
- Why ask it
- Evidence that dies with the vendor was never yours.
- What a good answer contains
- Verification that needs neither the vendor's service nor its network.
- How elan1 answers
- This is the L3 question: "Does this survive the vendor?" From L2, the free offline verifier runs on your machine with no network. AvailableL2 · L3
Q42How do we leave, and does leaving need your cooperation?
- Why ask it
- Exit terms are cheapest to agree before signature.
- What a good answer contains
- Documented export formats, a tested exit runbook, and no step that depends on the vendor.
- How elan1 answers
- State leaves in published custody formats. An exit that needs our cooperation is not an exit. AvailableNo level · elan1 Run
10. What the vendor does not cover
The last group asks the vendor to draw its own boundary. A good vendor answers these quickly and in writing; a hesitant answer here usually predicts an over-broad answer elsewhere.
Q43What does your product not do that we might assume it does?
- Why ask it
- The gaps matter more than the features in a control review.
- What a good answer contains
- A published "does not do" list per product.
- How elan1 answers
- Every elan1 product page has a "What it does not do" section. elan1 sees only writes that take the governed path. AvailableAll pages
Q44Does a verified record prove the decision was right?
- Why ask it
- Integrity of a record is often mistaken for correctness of what it records.
- What a good answer contains
- A plain statement that verification proves the record is unchanged, not that the decision or rules were sound.
- How elan1 answers
- No. Verification shows the record has not changed since it was sealed; it does not show the decision or the rules were right. Not coveredL1 and L2
Q45Which regulatory duties stay with us?
- Why ask it
- Tools support obligations; they do not discharge them.
- What a good answer contains
- A per-framework list of what the product helps show and what remains yours.
- How elan1 answers
- Classification, conformity assessment, your management system, consent, notices, DPO duties and your breach process stay yours. elan1 certifies neither you nor itself. Not coveredNo level
Q46Which design questions are still open?
- Why ask it
- A vendor with no open questions is either finished or not telling you.
- What a good answer contains
- A published list of open decisions, each with its status.
- How elan1 answers
- Published on Disclosures: DPDP erasure alongside the append-only chain, and the salting choice for F14, each with its status. OpenNo level
11. Scoring the answers
Score each answer on the four-step scale in Figure 2. Weight the groups to your own risk; a regulated lender will weight the evidence and residency groups more heavily than an internal operations team. Four questions decide whether the rest matter: Q02 (one route), Q03 (no model in the allow), Q15 (tamper evidence you can check) and Q33 (failure direction). An unsupported assertion on any of those four should score zero.
Figure 2
A four-step scale for scoring answers
| Score | Name | What it means |
|---|---|---|
| 0 | No answer | Declined, or answered a different question. |
| 1 | Assertion | A statement with no level, mode, status or artefact. |
| 2 | Documented | A published design, schema or policy, with its status. |
| 3 | Demonstrated | Shown on your data or a specimen, and checkable by your team. |
Two habits make the scores comparable. First, ask for the artefact, not the adjective: a schema, a test name, a policy page with a version. Second, record the status the vendor gave. A “3” for a capability on a roadmap and a “3” for one in production are different scores, and your evaluation should say which it was.
If elan1 is on your shortlist, score us the same way. Each of our answers points to a published page you can check, and a walkthrough or an early-adopter design partnership can take an answer to a 3 on one real process.
References
Every reference is a page on this site. Where a page and this paper differ, the page is newer: tell us and we will correct the paper.
- [1]What we claim, and what we don't/trust/claimsEvery elan1 claim with its level, mode and status.
- [2]Disclosures/trust/disclosuresWhat we disclose, including open questions.
- [3]Security, residency and data handling/trust/securityResidency domain, write credential, evidence protection, subprocessors.
- [4]The proof record/platform/proof-recordThe 16 fields of Seal v6, with specimens.
- [5]Assurance levels/platform/assurance-levelsL1 Guarded, L2 Attested, L3 Proven, and Mode A and Mode B.
- [6]Contracts and integrations/platform/integrationsKernelPort v1, fusion.*/v1 contracts, conformance K1–K7 and C1–C14.
- [7]Pricing/pricingThe governed action meter; list prices, exclusive of GST.
- [8]Readiness check: 12 questions/resources/readiness-checkA shorter self-assessment for your own team.
- [9]DPDP and the append-only chain/resources/library/dpdp-and-the-append-only-chainOur full position on erasure and the evidence chain (Q28).