If you are a federal prime putting together a bid that needs an AI capability, you are about to add a name to the team that you may not be able to fully vet. The market is full of people who have rebranded as AI specialists in the last eighteen months, and a lot of them have never deployed anything inside Government Community Cloud. Put one of them on your bid and the risk is yours: a weak past-performance story at evaluation, a delivery that stalls when commercial assumptions hit the government boundary, and your name on the contract when it does.
So here is GCC subcontractor vetting from the other side of the table. I am a sub. I want you to vet me hard, because the questions that would expose a pretender are the same ones I would pass. Use them on me and on everyone else you are considering.
First Question: GCC or Just Commercial With a Flag On It?
This is the one that separates the field. Ask the candidate to name specific GCC constraints they have hit and worked around. Real answers sound like this: connector availability is narrower than commercial, Azure OpenAI is not in every government region, app registration consent flows behave differently, and the commercial Graph documentation will lie to you in ways you only learn by shipping. If the answer is a confident “GCC is just M365 for government, same thing,” you have found someone who has only ever worked in commercial and does not know what they do not know.
The tell is specificity. Someone who has built in GCC has scar tissue and can describe it. Someone who has only demoed in a commercial trial tenant speaks in generalities and gets vague exactly where the hard parts live.
Second Question: What Did You Ship, Not What Did You Prototype?
A demo proves nothing about delivery. Ask what the candidate has put into production and handed off to a government team to operate, and then ask the question that does the real work: “show me the handoff documentation.” Anyone can stand up an agent that answers questions on a screen. The people who can actually deliver have artifacts, runbooks, architecture notes, the boring paper that proves a system was built to be owned by someone other than its author.
Ask to see the handoff documentation. Demo people do not have it. Builders do.
If the past performance is all pilots and proofs of concept that never reached production, that is your delivery risk in plain sight. Pilots are where AI projects go to feel productive without shipping.
Third Question: Can They Speak Compliance Without a Deck?
You need a sub who designs inside the rules from the start, not one who treats compliance as a phase at the end. Ask how they handle identity for an agent, what gets logged, how retrieval is scoped, and whether they design to NIST 800-171 and CMMC control objectives as a default. The right answer involves least privilege, scoped identities, citation-bound retrieval, and audit logging, described as ordinary engineering rather than a special add-on.
A candidate who can only talk about compliance by reading from a marketing slide is going to build you something that has to be retrofitted to pass an assessment, and retrofitting governance is expensive and rarely clean. You want governance baked in, not bolted on.
Fourth Question: How Does the Agent Authenticate and What Does It Log?
Get concrete on identity and data handling, because this is where a weak build hurts you in an audit. Does the agent run under a scoped managed identity or app registration, or did they wire it to a standing privileged account because that was faster? Is retrieval constrained to authorized, labeled sources, or will the agent ground answers in whatever it can reach? Is every action logged with requester, parameters, and result in a way an assessor can query?
These are not gotcha questions. They are the difference between a system that is audit-ready and one that produces a finding the first time someone looks closely. On a federal contract, the second kind becomes your problem, not the sub’s.
Fifth Question: Is the Small-Business Status Real and Verified?
If you are adding a sub partly for socioeconomic credit, verify the status rather than taking it on faith. Confirm an active SAM registration, a valid UEI and CAGE, and the right NAICS codes for the work. If a sub claims a certification, check whether it is granted or merely in progress, because the two are not interchangeable and assuming the wrong one can create a problem at award. A sub who states their status precisely, including what is pending versus confirmed, is showing you they understand how procurement actually works.
Sixth Question: Do They Tell You What They Cannot Do?
This is the quiet one, and it might be the most important. A sub who claims everything is the most dangerous name you can put on a bid. The honest candidate will tell you plainly where the boundaries are: GCC yes, GCC-High no if that is the truth; aligned to control objectives, not holding a FedRAMP authorization themselves. Overclaiming on a federal proposal is not confidence. It is exposure that lands on the prime.
I would rather lose a spot on a bid by being honest about a limit than win one by overstating and getting both of us into trouble at delivery. A sub who knows their edges is a sub who will not surprise you after award.
Where Puget Sound AI Lands on These
For the record, since I just handed you the questions: Puget Sound AI is a solo, veteran-owned small business (VOSB), with SBA VetCert in progress, not yet granted, and I will tell you that rather than imply otherwise. SAM is active, UEI and CAGE are on the capability statement, and the NAICS codes are 541512, 611420, and 541519. Every solution is built GCC-native and architected to operate within Microsoft’s FedRAMP-authorized GCC boundary, aligned to NIST 800-171 and CMMC control objectives. I work on firm-fixed-price and time-and-materials, and I am comfortable as a sub on someone else’s paper.
The single-engineer model is the point, not a limitation. The person you vet is the person who builds, so there is no bench-and-switch between the resume you evaluated and the resource who shows up. For the deeper argument on why a builder beats a delivery org on a focused engagement, see the piece on why your government AI project should be run by the engineer.
If you are building a bid that needs a GCC AI capability and you want a sub who will pass your own vetting, that is exactly the conversation to have. Let’s talk.