Each candidate goes through a simple process: record the source, review what it could be useful for, check the risks and constraints, and keep evidence for the decision. I also built a small Python policy gate and offline test fixtures so some checks can be repeated without relying on live services.