Sources & storage
Define ingress, residency, retention, deletion, and backup responsibilities.
04 · Deployment boundaries
Trust starts with a boundary everyone can name.
A deployment conversation should make data location, identity, policy enforcement, audit custody, and shared responsibilities explicit before a pilot begins.
People & services
Define authentication, roles, groups, service identities, and session policy.
Allowed actions
Define authorization decisions, review gates, exceptions, and separation requirements.
Evidence of action
Define event capture, access, retention, review, export, and verification procedures.
Customer responsibilities
- Approve architecture and handling requirements
- Operate identity, network, and data-source controls
- Name reviewers and evidence owners
- Accept residual risk and production readiness
Summit responsibilities
- Document supported deployment patterns
- Map configured controls to buyer requirements
- Provide verification steps and evidence artifacts
- Disclose gaps, assumptions, and exceptions