AI assurance software, model firewalls, and GRC suites are not interchangeable. The buying mistake is collapsing all three into one RFP.
Ask: Can it register agents, MCP, and RAG as first-class types? Can it test the HTTP API you ship? What happens when a scanner is missing? Can you run on-prem? Does the score list deductions? Are findings distinct from incidents?
Ask what it is not. If the vendor is a GRC suite, you still need labs. If the vendor is a prompt firewall, you still need inventory and evidence. OptimaTrust is continuous AI assurance and security. OptimaGRC is GRC.
Use the checklist on a working session: bring one agent API and one shadow endpoint. Empty results should stay empty.