How do we test security and operating responsibility?

Request a complete application data path rather than only the underlying cloud service's policy. For example, Microsoft documents its service's processing/retention, but the supplier must also explain its own stores, support access and backups.

Test with non-sensitive data: ordinary-user access, another project's access, deletion, export and a simulated outage. Ask who can alter prompts, rate tables and approval rules, and how those changes are reviewed. A proposed future security feature is not present evidence.