Could your organisation safely let an AI agent initiate payments today? Twelve questions across four domains — policy & mandates, protocol formalisation, financial-crime controls, and MCP runtime operations. Deterministic scoring, a graded result, a remediation map, and a §4 OpenChainGraph artifact with execution_hash.