33 checks, traced to sources
Four guardrails (an evaluation gate, identity on every model call, spend tied to what shipped, a person where it matters) and a foundation check. Each one links to Microsoft documentation, or says it is our own recommendation.