Answer 18 questions in 6 areas. You get a verdict, a risk register, a 30/60/90 day plan and a PDF. It is a self-assessment, not an audit or a certificate. Unknown is a valid answer: it scores zero and goes into the evidence gaps.
What the scan returns when every question is answered with its third option, a team part of the way there. The verdict, the first safe use case and the risks are the scorer's own output for those answers.
Verdict
Discovery-ready
You can scope a safe pilot after a short discovery pass.
First safe use case
Read-only internal knowledge assistant with human review. Do not automate actions yet.
Top of the risk register
criticalExcessive agency
Autonomous write access is not a first pilot. Start read-only or require human approval.
highPermission boundary uncertainty
AI retrieval inherits the quality of source permissions. Dirty ACLs become data exposure.
highSensitive data exposure
The workflow may process confidential, financial, legal, health, or special-category data.
A missing owner, policy, test, or incident path goes into the plan and lowers the score.
Each control is a real deployment question: who owns the workflow, where the data lives, what the AI may do, what gets logged, what happens when it fails. Every answer is taken at face value. Nothing here opens your tenant, your code or your data, so the result is worth exactly what the answers are, and Unknown is a valid answer.
One of four bands, from "unsafe to deploy" to "production-ready for a bounded use case".
Every risk signal your answers raise, ranked critical, high or medium, with the reason.
A fixed 30/60/90 sequence with your first evidence gap and your first safe use case written into it.
The verdict, both registers and the plan, in six sections you can forward internally.
6 dimensions, 3 controls each
Use case
Workflow clarity, decision rights, value hypothesis
Data
Sources, permissions, sensitivity, retention
Governance
Owner, policy, oversight, assessment trigger
Security
Prompt, tool, supplier, and model risk controls
Architecture
Identity, integration, logging, environments
Operations
Evaluation, incidents, training, rollout ownership
The controls were written against public framework material: NIST AI Risk Management Framework, NIST AI 600-1 Generative AI Profile, ISO/IEC 42001:2023, EU AI Act overview, OWASP Top 10 for LLM Applications, Microsoft Cloud Adoption Framework for AI. No control cites a clause or maps to one.
Evidence model
A team can understand its gaps without being ready to deploy. It can also have a technically strong prototype with unacceptable use-case risk. The scan reads your answers and never your systems.
This self-assessment is informed by public framework material and scores what you declare. It verifies nothing, and it is not a legal opinion, compliance audit, conformity assessment, certification, or substitute for testing the target environment.
Each answer contributes to its dimension, to risk signals, to certainty, and to any hard blockers, which can hold the verdict at unsafe even when other controls score well. Every control is answered before a result renders.
Unknown is an option on all 18 controls, and it is an answer rather than a hole in the model. It scores zero, it counts as zero certainty, it carries that control's worst risk, and it lands in the evidence register instead of quietly taking a favourable default.
The result lists why each material risk was raised and which documents, tests, owners, or technical evidence you said were missing. The list is capped, and the result says so when it truncates.
The recommended starting shape reduces decision authority, data exposure, and integration scope. It remains a planning recommendation until something verifies it.
Observed: the tool read it. Declared: you told the tool. Modelled: the tool calculated it from those. Not read: the tool could not see it.
18 controls across 6 dimensions, 3 in each. Every control offers Unknown, which scores zero and becomes an evidence gap instead of a favourable default.
No. Every input is an answer you select. Nothing connects to your tenant, repository, code, logs, or data, and no answer is verified. That is why the output is a self-assessment and why the result is worth exactly what your answers are worth.
A readiness verdict, readiness and risk scores, self-reported certainty, a six-axis view, a risk register, an evidence-gap list, a first safe use case, a 30/60/90-day plan, and a PDF brief in six sections. It also names the workshop focus that fits your weakest dimension and links to it.
No. It is a structured self-assessment informed by public frameworks. It does not establish legal compliance, certify an AI management system, or replace a technical and legal review.
Scoring runs in your browser. A result is submitted only when you intentionally provide a work email for follow-up or report delivery.
Take the register to a two hour workshop. The AI and tenant evidence register and the Copilot gate record are two of its seven items.
ITSailor field library
Use the free packs for agent guardrails, governance decisions, operational evidence, and workflow engineering. Every available free resource remains browsable below.
21 free resources in the verified catalog.
Plan, run and evidence recovery drills without inventing the process during an incident.
6 working templates · drill evidence · recovery validation
Downloadable packA six-sheet Excel model with live formulas for cloud and SaaS spend: baseline, savings backlog, commitment break-even, showback, tagging and a FinOps mapping.
6-sheet Excel model · formulas · prioritised savings backlog
Downloadable packTrack renewals, audit licence use, assess new vendors and prepare evidence before commitment windows close.
6 working templates · renewal calendar · audit and reclaim procedures
Downloadable packStructure discovery, pilot waves, cutover, rollback and hypercare for cloud and Microsoft 365 migrations.
7 working templates · cutover gates · rollback procedure
Downloadable packThree KQL detections plus the catalogue, tuning, hunting and review records needed to operate them.
3 KQL samples · 2 runbooks · monthly operating review
Downloadable packRead-only PowerShell and KQL examples for Secure Score, inactive licensed users and failed sign-in bursts.
2 read-only Graph scripts · 1 KQL query · permissions guide
Downloadable packRecord ownership, architecture, handover evidence and supplier-exit questions before a dependency becomes lock-in.
4 neutral templates · ownership map · handover and supplier-exit checks
Downloadable packOperational templates for triage, device isolation, email purge, identity compromise and detection review.
7 working templates · 4 response procedures · review records
Downloadable packDiscovery, architecture, security baseline, policy and operating-review templates for Azure platform planning.
6 planning templates · policy intent · operating review
Downloadable packVersioned workpapers for reviewing Microsoft 365 controls, evidence, permissions and remediation priorities.
48 source-linked checks · permission audit · gap analysis
Downloadable packTwo sanitised n8n workflow exports, a broken-flow triage runbook and the operating notes needed to adapt them safely.
2 sanitised n8n exports · triage runbook · operating notes
Get an AI deployment verdict, risk register, and 90-day plan from what you declare.
18 declared controls, a risk register and a 30/60/90 plan
Interactive toolModel one workflow from your own operating numbers and see the range it produces.
Your own baseline of six inputs, three cases and 7 scored questions of 10
Interactive toolRead your own Azure cost export without it leaving your browser.
Microsoft's export schemas, parsed in your browser
Interactive toolCheck whether your domain publishes SPF, DKIM, DMARC, MTA-STS and TLS-RPT, and whether it is on a public blocklist.
Live DNS checks of 8 record types and 29 DKIM selectors
Interactive toolCheck whether the add-on you are about to buy is already in the plan you hold.
28 add-ons, each verdict linked to the Microsoft page it was read from
Interactive toolOffboard a Microsoft 365 leaver in the right order, with the commands and a record of what was done.
Ordered leaver steps, PowerShell with sources and an evidence record
Interactive toolFind the SaaS apps your users, spend and sign-in logs reveal, and the licences nobody uses.
Three scan paths; CSV exports are processed in your browser
Interactive toolReview your Microsoft 365 security posture across 48 risk-weighted controls.
48 checks in 6 areas, each linked to its Microsoft source