Fictional demo

Sample AssureDeck Review Pack

A buyer-facing example of the evidence pack format for a fictional AI support workflow. It shows the structure, not a real customer result.

View answer bank View gaps

Status: fictional sample. Not legal advice, certification, audit opinion, penetration test, or a real customer review.

Executive summary

Northstar Ops AI: OpsPilot Agent

Reviewed workflow: support-ticket triage, CRM lookup, draft customer replies, and workflow task creation.

Model/provider pathReady

Provider route, region, retention, and training-use position documented.

Customer data handlingReview

Data classes mapped; admin retention documentation still needed.

Agent permissionsReady

Read/write actions and human approval gates documented.

Prompt injectionReview

Direct tests exist; indirect tests need CI-backed evidence.

Audit reconstructionGap

Internal reconstruction works; customer-facing export is planned.

System scope

AI feature inventory

Feature	Purpose	Customer data involved
Ticket triage assistant	Classify support ticket priority and topic	Support ticket text, account tier
CRM context lookup	Retrieve customer plan and account owner	CRM metadata and recent internal notes
Draft reply generator	Draft response for support agent review	Ticket text and KB snippets
Workflow task creator	Create internal follow-up task	Ticket id, account id, task summary

Permissions

Agent action matrix

Tool/action	Read/write	Risk	Permission scope	Human approval
Read ticket	Read	Medium	Tenant + user role	N/A
Read CRM account	Read	Medium	Tenant + OAuth scope	N/A
Draft reply	Write draft	Medium	Helpdesk draft scope	Yes before send
Send reply	External action	High	Human support agent only	Always
Create internal task	Write internal	Medium	Workflow task scope	User confirmation

Reusable answers

AI security questionnaire answer bank

What customer data does the AI process?

Support tickets, selected KB snippets, CRM account metadata, and workflow task context.

Ready

Is customer data used to train models?

No. Customer data is not used to train foundation models.

Review

What autonomous actions can the agent take?

It can recommend, draft, and create internal tasks after confirmation. It cannot send external replies without human approval.

Ready

Can you reconstruct an AI incident?

Partially. Internal admins can reconstruct action path; self-serve customer export is planned.

Review

Gap list

Prioritized remediation plan

Priority	Gap	Recommended fix
P0	PHI exclusion is not explicit enough	Add prohibited-data language and admin warning
P1	Indirect prompt-injection tests are not CI-backed	Add regression suite for ticket/email/HTML payloads
P1	Audit reconstruction is internal-only	Add exportable audit summary
P2	Tool/action docs are too technical	Create buyer-facing permission page

What changes in a paid pilot

AssureDeck replaces fictional placeholders with the customer's real architecture, model/provider settings, DPA/subprocessor references, tool inventory, audit-log schema, customer-facing answer bank, confidence levels, and unsupported-claim flags.

The pilot does not invent security claims or certify the product.