This seems to be a case for 'trust but verify' - it's also worth remembering that reputational risk and purposes rebound differently for different participants.