Most AI red-team output we've seen on contract reads as a long list of prompts that produced a bad output, with no structure underneath. That's interesting to a researcher and unactionable to a reviewing engineer. The acceptance gate wants a different artifact: a structured statement of what was tested, what the model's response distribution looked like, and what the residual risk is.
We organize the red-team report around four categories. Prompt injection: can an adversarial input change the model's tool-calling behavior or extract its system prompt? Capability elicitation: can the model be coaxed into producing outputs that violate the documented use case (e.g., generating exfiltration code from a defensive cyber assistant)? Tool misuse: can the model be tricked into calling a permitted tool with attacker-chosen arguments? Refusal robustness: does the model refuse the right things, and does it refuse them reliably across paraphrases?
Each category gets an eval suite, not a list of anecdotes. The eval suite has a measured pass rate on a fixed test set that's versioned alongside the model. A reviewer can compare model version N to N-1 and see whether refusal robustness regressed.
The artifact a reviewer actually reads is a one-page summary of pass rates, a three-page commentary on the highest-impact failures, and a structured POA&M for anything below threshold. The raw eval logs are an appendix. Everything is reproducible: the same evals run again on a fresh deployment must produce the same numbers within a documented tolerance.
Two things this discipline changes. First, the agent shipped to acceptance review is the same agent the eval ran on, not the latest commit. Model artifact, prompt, tool catalog, and orchestrator code are all versioned together. Second, the red-team is a continuous activity, not a milestone. The same evals run on every release candidate and the trend chart is part of the next release's acceptance package.
This is the part where CMMI Level 3 process maturity stops being a soft differentiator and starts being load-bearing. The discipline above is the same discipline we already apply to code. Adding model artifacts, prompts, and evals to the configuration management baseline is the smallest possible delta.