Select an operating capability, not a model
The sourcing decision includes workflow design, data, retrieval, models or rules, integrations, identity, human review, monitoring, support, change control, and exit. A product subscription can reduce some development responsibility, but it does not automatically transfer accountability, integration effort, data risk, or operating ownership.
Four decision paths
| Path | Use when | Primary risk |
|---|---|---|
| Buy | A mature product fits a standardized workflow and the supplier can meet control, integration, support, and exit requirements. | Assuming procurement transfers responsibility for adoption, data, model change, and outcome quality. |
| Configure | A platform provides useful primitives while client-specific prompts, retrieval, rules, connectors, permissions, evaluation, and workflow remain necessary. | Allowing configuration to become undocumented custom code that cannot upgrade or migrate. |
| Build | The workflow creates strategic differentiation or available products cannot meet critical control, residency, integration, or economic requirements. | Underestimating product management, reliability, security, support, revalidation, and lifecycle cost. |
| Defer | The problem, evidence, controls, economics, or ownership are not ready for a defensible commitment. | Treating defer as passive delay rather than a time-boxed evidence plan. |
Mandatory gates before weighted scoring
- The intended process outcome and baseline are defined.
- Data authority, privacy, security, residency, and contractual requirements are satisfiable.
- Critical system quality and human-oversight thresholds can be tested.
- The client can integrate, operate, monitor, support, and stop the option.
- Client data, evaluation assets, workflow logic, records, and exit requirements are addressed.
- No option depends on an unresolved critical exception that a high average score would conceal.
Compare total cost per accepted outcome
The economic model should include acquisition, implementation, data work, security and assurance, model or license consumption, infrastructure, human review, operations, monitoring, revalidation, change, support, and exit. Divide that cost by outcomes meeting the business acceptance definition—not by tokens, seats, or requests.
Portability is an operating control
Data and records
Bulk export, metadata, audit history, retention, and deletion evidence.
Workflow and prompts
Documented logic, templates, rules, configuration, and replaceable adapters.
Evaluation
Client-owned cases, rubrics, item-level results, thresholds, and regression history.
Observability
Logs, metrics, traces, cost, version identifiers, and incident evidence in usable formats.
Change and deprecation
Advance notice, testing window, pinning, rollback, transition support, and price protection.
People and support
Skills, RACI, knowledge transfer, on-call burden, continuity, and key-person risk.
