Ship quality software, faster

How an AI readiness assessment works

1. 1

   Step 1 of 6: Authorize the target

   An admin or owner confirms they may test the declared scope: a chat page URL, an API endpoint or a trace source. Changing the scope withdraws the authorization.

2. 2

   Step 2 of 6: Select an approved plan

   GoQA builds a bounded plan from reviewed test templates that fit your target. Every case shows where it came from; you can deselect cases before running.

3. 3

   Step 3 of 6: Run bounded tests

   Runs stay inside limits on prompts, request rate, tokens, cost and time, and can be cancelled at any point.

4. 4

   Step 4 of 6: Review evidence and findings

   Each result keeps the input, the output, the evaluator and its version. Findings are named precisely (for example unsupported claim or policy violation); uncertain or critical judgements go to a human reviewer.

5. 5

   Step 5 of 6: Remediate and retest

   Fix the issue and run again. Confirmed failures can become regression cases so later runs check them automatically.

6. 6

   Step 6 of 6: Apply a release gate

   A gate turns the assessment into pass, block or needs approval — for example block on any unresolved critical finding. It supports a release decision; it is not a certification.

In order: authorize the target → select an approved plan → run bounded tests → review evidence and findings → remediate and retest → apply a release gate.

Three levels of evidence

Each level adds evidence and the workflow stays the same. URL-only testing is not available yet; connect an API or send traces.

1. Evidence depth 1 of 3

   URL-only (black-box)

   URL-only testing is not available yet. When released, GoQA will interact with your chat page only through the visible interface, within the scope you declare.

   Can show

   • Visible answers to bounded, defensive test prompts
   • Refusal quality and disclosure behavior shown in the UI
   • Visible citations, error states and response timing

   Cannot show

   URL-only testing observes externally visible behavior. It cannot prove hidden prompts, temperature, retrieval documents, tool calls, guardrails, memory, or internal reasoning. Findings describe observable behavior and potential risks. Connect an API or trace source for deeper evidence.

2. Evidence depth 2 of 3

   API-connected

   GoQA calls your OpenAI-compatible chat endpoint directly. Credentials are encrypted and never shown again.

   Can show

   • Exact model responses with token usage, cost and latency
   • Configuration sensitivity (temperature, top_p, max tokens, seed)
   • Structured output and schema checks

   Cannot show

   • Retrieval documents, tool calls or memory inside your application unless the API returns them
   • Behavior of UI layers in front of the API
3. Evidence depth 3 of 3

   SDK / trace-connected

   Your server sends run, retrieval, tool, agent-step, latency, token, cost and error events through the GoQA SDK.

   Can show

   • Full agent trajectories: tool selection, arguments, order, approvals and delegation
   • Completion claims checked against recorded tool results
   • Loops, budgets, errors and recovery from reported events

   Cannot show

   • Anything your code does not report (uninstrumented tools, hidden prompts, memory stores)
   • Whether reported timings, tokens or costs are accurate — GoQA does not re-measure them