# The questions > The questions people actually ask about AI on the enterprise surface, in the words they use, with what each one is really testing. Source: https://brocs.fyi/resources/questions/ Framework: BROCS (Build, Run, Observe, Control, Secure), brocs.fyi. CC BY 4.0, attribute to brocs.fyi. --- These come out of real rooms: procurement calls, architecture reviews, and the twenty minutes after a demo when the person who has to sign starts asking what they actually care about. The phrasing is theirs. Each one is mapped to the letters it lands on, with what the question is really testing underneath the words, and what a good answer looks like. None of the answers name a product. If your platform can answer them, it does not matter whose it is. Notice how many land on [Control](/control/). That is not an accident of sampling. The questions people ask under pressure are almost all about whether they can change something, prove something, or stop something, which is the Control surface described from the outside. ## 1. Your cloud is down, or at least your region. Can you build and run somewhere else? How long does that switch take? Letters: run, control. What it is really asking: Whether portability is a property of the system or a slide. The follow-up question is the real one: how long, and who measured it. A good answer names a second placement that exists today, a runbook someone has executed, and a number in hours that came from a drill rather than an estimate. A bad answer describes a capability in principle. Compute is the easy half; the switch time is almost always dominated by state, meaning where the database is, how current the replica is, and how long the vector index takes to rebuild. If nobody can say what the index rebuild costs in hours and money, the recovery time is unknown rather than short. ## 2. Can you guarantee our data and code never leave the perimeter? Then how does anyone work remotely? Letters: run, control, secure. What it is really asking: Whether remote access is understood as moving the work to the person or moving the data to the person. Those two requirements only conflict if the work happens on the endpoint. The resolution is to move the workspace rather than the data: the editor, the terminal, and the agent run inside the boundary, and what crosses the wire is pixels and keystrokes. The laptop becomes a viewport. Then "never leaves the perimeter" is an architectural fact you can demonstrate rather than a policy people have to obey, and the answer to a lost laptop is to revoke a session instead of opening an incident. ## 3. How do you track what consultants are accessing while they are in your network? Letters: control, observe. What it is really asking: Whether external people have their own identities, time-bound access, and a per-person record, or a shared credential and a VPN. The shape that works is federation rather than accounts: the consultant authenticates against their own employer's identity provider, your ingress maps that to a scoped role, and the grant carries an expiry that matches the statement of work. Every request is then attributable to a named person without your directory ever holding them. The failure shape is a shared credential in an email, which produces access records that say "the contractor account" and outlive the engagement by years. If you cannot answer "which consultant opened that record on the 14th", you do not have oversight, you have a network. ## 4. Can you provide tooling beyond a terminal server, an SSH session, or a VPN? Letters: build, control. What it is really asking: Whether the sanctioned remote path is good enough that people use it, or bad enough that they route around it. This is a usability question with a security consequence. A remote path that is slower and worse than working locally loses, and the way it loses is that people copy the repository to the laptop "just for today". So the bar is a full working environment: the editor people already use, a real terminal, the agent tooling, the data connections, and enough responsiveness that nobody notices where it runs. If the only options are a jump box and a VPN, expect the data to be on the endpoint regardless of what the policy says. ## 5. What are your agents up to? What can they do and touch? How do you know they are doing what they are supposed to? Letters: secure, observe. What it is really asking: Whether anyone has written down the blast radius, and whether there is a record good enough to answer the third part after the fact. Three artifacts answer this and most organizations have none of them. A permissions document per agent, listing tools with the operations each permits, the identity it acts as, what it can read, where it can send bytes, and what it can spend. A trace per run, recording every tool call with its arguments and the identity it was made under. And a sampled review after the fact, because approval-before-action gets clicked through within a week while nobody ever reads what actually happened. ## 6. How do we know someone in accounting is not using the company assistant to write their novel? Letters: secure, observe. What it is really asking: Whether inference is attributed per user and per application at all. The novel is rarely the actual concern. You know the same way you know anything else about usage: every inference call carries an application, a team, and a user, because it went through a gateway rather than a distributed provider key. Then unusual patterns are visible without anyone reading prompts, which matters because reading prompts to enforce acceptable use is both invasive and unreliable. Worth being honest about the ranking, though: personal use is a policy annoyance, while the same missing attribution also means you cannot answer what anything costs, who caused a spike, or which team is actually getting value. Fix the attribution and the novel takes care of itself. ## 7. Are people feeding corporate data, IP, PII, or PHI into hyperscaler model endpoints without a BAA or approval? Letters: build, control, secure. What it is really asking: Whether endpoint eligibility is enforced by a system or documented in a policy. Assume yes until something enforces otherwise, because the sanctioned path is usually slower than the browser tab. The enforceable version has two halves. Eligibility is data: which endpoints are covered by which agreement is recorded somewhere the routing layer reads, so a request tagged as containing protected data can only reach a covered endpoint. And discovery is separate work, because the traffic you most need to find is the traffic that never went through your gateway. Start with expense reports and the OAuth grant list in your identity provider; both are faster than network telemetry and usually more revealing. ## 8. How do I provide consistent tooling and runtime across every cloud and the local datacentre? Letters: build, run. What it is really asking: Whether the platform abstracts the deployment unit and the model endpoint, or tries to abstract whole clouds. The hybrid cloud lesson applies directly: abstract the workload and the small set of interfaces it depends on, not the infrastructure. In practice that means a containerised deployment unit, a model endpoint that is a capability rather than a provider name, object storage and SQL rather than proprietary equivalents, one federated identity provider, and a data plane that keeps serving when the central control plane is unreachable. Get those five right and placement becomes a configuration value. Get them wrong and every environment is a fork. ## 9. How do I let people do remote work without taking data or code with them? Letters: control, run. What it is really asking: Whether there is a zero-footprint path, and whether it is pleasant enough to be the default rather than the exception. Put the workspace inside the boundary and give the person a session, not a copy. Nothing syncs, nothing clones, and the controls that matter are the boring ones: clipboard and file-transfer policy on the session, egress restrictions from the workspace, and an idle timeout. The test is not whether the capability exists. It is whether an engineer would choose it on a normal Tuesday, because a zero-footprint path people avoid produces a footprint anyway. ## 10. What happens when someone crosses a border with a laptop and still needs access? Letters: secure, control. What it is really asking: Whether the laptop holds anything worth seizing, and whether access can be scoped by where the person currently is. Two separate problems, and conflating them is why this usually goes badly. The device problem is solved by the laptop holding nothing: if the workspace lives inside the boundary, an inspected or seized machine yields a browser and a revoked session. The access problem is that the same person, in a different country, may be subject to different rules about what they can reach, which means location has to be an input to authorization rather than a property of the network they dialled in from. Both are worth deciding before the trip, because the alternative is a policy written at an airport. ## 11. How do we govern cross-border data access when the person is in one jurisdiction and the data is in another? Letters: secure, control. What it is really asking: Whether residency is enforced at the point of processing or asserted in a diagram. Split the question in two, because the answers are different. Where the data is processed is a placement decision and it has to be enforced by the runtime and the routing layer: a request tagged for one region must not be served by a model or a workspace in another, and that is a control rather than a convention. Who may reach it is an authorization decision that has to take the person's current location as an input. The record that ties them together is the access log plus the trace, which is also exactly what a regulator asks for, so building it once serves both purposes. ## 12. How do we actually facilitate data sovereignty rather than promise it? Letters: run, secure. What it is really asking: Whether the sovereign paths are live options or roadmap items. Sovereignty is demonstrable or it is marketing. The demonstration has three parts. Inference happens somewhere you control, which means at least one of a local model, a model served through your own cloud account, or a contractually covered endpoint is running today rather than planned. Placement is a property of a workload rather than of an installation, so a new jurisdiction is a configuration change instead of a parallel platform. And the deployed system keeps working when the central control plane is unreachable, because a dependency on someone else's control plane is a dependency on someone else's jurisdiction.