Three weeks in, the customer's security team says the project cannot send any data to an external model. What do you do?

Strong answer

Meet them quickly and ask what specifically they need to be true: data residency, no training on their data, no retention, specific certifications, or no third-party processors at all. Each has a different answer: a region-pinned enterprise endpoint with zero data retention, a cloud provider they already have a contract with, a private deployment, or an open-weight model on their infrastructure. Bring a short data-flow diagram showing exactly what leaves which boundary. If the answer really is "nothing leaves", re-plan with a self-hosted model and reset the timeline and quality expectations with the sponsor in writing. Lesson for next time: security discovery belongs in week one, which is why it is a checklist in any serious FDE playbook.

Weak-answer indicators

• Tries to go around security via the sponsor
• Assumes the requirement cannot be met
• Does not update timeline and expectations