vetting-outside-code-and-models

To evaluate outside code and models for vendor trust, state the intended use and separate vendor claims from observed in-repo evidence. Document backup controls, proof, and release impact to decide whether to ship, defer, or block.

If an external dependency or model is hacked or changed, you must document the effects on data, credentials, permissions, and licenses. Unresolved gaps trigger a re-check and route to a decision: defer, block, or ship with risk.

Document evidence for external dependencies by keeping vendor and source claims separate from evidence you observed in your repo. Identify the owner, backup controls, and what would force a re-check to produce a supplier-trust artifact.

Assess release impact for unverified external models by identifying effects on data, credentials, permissions, and licensing. Route unresolved trust gaps through a clear decision flow to ship, defer, block, or escalate for review.

Block or defer shipping a new API or service dependency when observed evidence is missing or gaps remain unresolved. State what happens if the item is wrong or hacked, then route the decision to defer, block, or ship with documented risk.

Yes, vendor vetting requires separating source claims from observed repository evidence. State the intended use, name backup controls and proof, and identify impacts on data, permissions, and licenses to form a supplier-trust artifact.