AI Governance Engineer
GitHub

Where control moves when you buy

A procured system passes a due-diligence gate; then boundary evals and the controllable perimeter shrink, while inventory and collected supplier evidence grow.

By Updated First published

Where control moves when you buy A procured system passes a due-diligence gate; then boundary evals and the controllable perimeter shrink, while inventory and collected supplier evidence grow. Procured AI: the control budget moves The vendor's system SaaS with an LLM, an API model, a vendor agent Due diligence Layer 02 Inventory & Transparency Grows: registry entry, owner and scope Layer 03 Evals & Red Teaming as Evidence Shrinks: boundary evals, vendor's evidence Layer 04 Runtime Controls & Observability Shrinks: scopes, identity, observed traffic Layer 05 Assurance & Continuous Compliance Grows: supplier docs, model card, AIBOM Evidence you collect, not produce The less of the model you own, the more of your control budget moves from testing it to bounding it and evidencing the supplier.
Where control moves when you buy What happens to the stack when you buy the model instead of training it: boundary evals and the controllable perimeter shrink, while inventory and collected supplier evidence grow behind a due-diligence gate. Budget your controls for bounding the system and evidencing the supplier, not only for testing it. Drawn from chapter 04.

Text alternative

A procured system (SaaS with an embedded LLM, an API-only foundation model, or an agent inside a vendor's product) first passes a due-diligence gate, the Vendor / Model Due-Diligence Gate pattern. Layer 02 Inventory & Transparency grows: the vendor's system still needs a registry entry, an owner and a scope. Layer 03 Evals & Red Teaming as Evidence shrinks to boundary evals of the vendor's system as a black box and reliance on the vendor's own evidence. Layer 04 Runtime Controls & Observability shrinks to the perimeter you control: the tool scopes you grant, the identity you issue the vendor's agent and the traffic you can observe. Layer 05 Assurance & Continuous Compliance grows: supplier documentation, model card and any AIBOM become evidence you collect rather than produce. The less of the model you own, the more of your control budget moves from testing it to bounding it and evidencing the supplier.

Download

Every file carries the attribution band "aigovernanceengineer.com · CC BY 4.0 · v0.5.0" inside the image, and the version is in the file name, so a copy always says where it came from and which edition it shows. The SVGs keep the text live: the first follows the viewer's light or dark setting, the other two fix one theme for slides and print. The PNGs are drawn with the site's own typefaces.

A procured system passes a due-diligence gate; then boundary evals and the controllable perimeter shrink, while inventory and collected supplier evidence grow.
The PNG, light, 1600 px wide, as it downloads (shown here as a lighter copy).

Reuse and credit

The figure is published under CC BY 4.0: you may copy, share and adapt it, commercially too, provided you give appropriate credit, link to the licence and say if you changed it. Keep the attribution band in the image. A credit line that covers title, author, source and licence:

“Where control moves when you buy” by Jorge García Aibar, aigovernanceengineer.com (https://aigovernanceengineer.com/figures/procured-ai-control), v0.5.0. Licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).

Embed with HTML

<figure>
  <img src="https://aigovernanceengineer.com/downloads/figures/procured-ai-control-v0.5.0-light-1600.png" alt="A procured system passes a due-diligence gate; then boundary evals and the controllable perimeter shrink, while inventory and collected supplier evidence grow." width="800" height="1206" loading="lazy">
  <figcaption>
    <a href="https://aigovernanceengineer.com/figures/procured-ai-control">Where control moves when you buy</a> by Jorge García Aibar,
    aigovernanceengineer.com, v0.5.0.
    Licensed under <a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>.
  </figcaption>
</figure>

Embed with Markdown

![A procured system passes a due-diligence gate; then boundary evals and the controllable perimeter shrink, while inventory and collected supplier evidence grow.](https://aigovernanceengineer.com/downloads/figures/procured-ai-control-v0.5.0-light-1600.png)

*[Where control moves when you buy](https://aigovernanceengineer.com/figures/procured-ai-control) by Jorge García Aibar, aigovernanceengineer.com, v0.5.0. Licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).*