Procurement Question Bank
Twenty-six questions to ask any vendor supplying agents or agentic features. The vague answer is itself the finding.
Ask these of any vendor supplying agents, agent platforms, or agentic features. Insist on specifics; the vague answer is itself the finding.
Identity and authority
- Does each agent receive a unique identity, or do agents share a service principal?
- How is delegated authority represented, and can we inspect a delegation chain?
- What is your agent offboarding process? (Most vendors have no answer. Note it.)
- Can agent identities be governed in our identity provider, and is that enforcement or inventory only?
Credentials
- What credentials exist in the agent execution context, and what are their lifetimes?
- Are credentials task-scoped or service-scoped?
- How quickly can we revoke, and is that measured?
Isolation and egress
- Describe the execution isolation model and how it is verified in the running environment.
- Enumerate every outbound network path available to an agent runtime.
- Is the package or artifact proxy in your production vulnerability management program?
- Do agents processing untrusted input share an egress path with privileged agents?
Actions
- Where is tool authorization enforced—in the model, the orchestrator, or a policy engine?
- What is the default for an unknown tool or unknown destination?
- What velocity and blast-radius limits exist, and do they halt or alert?
- Are authorization decisions recorded tamper-evidently, and can we export them?
Data and memory
- How is retrieval scoped to the invoking user’s entitlements, and at which layer?
- What persists in memory, for how long, and who can write to it?
- Is context isolated between users and tenants? Demonstrate it.
Supply chain
- Which models, and will you notify us before a version or safety-configuration change?
- How are tool definitions and MCP servers versioned, signed, and reviewed?
Detection and response
- What telemetry do you emit, in what format, and can we ingest it into our SIEM?
- What is your kill switch, what is its time-to-effect, and have you measured it?
- What is your notification commitment if your agent causes an incident affecting us?
- Will you support us during an incident involving your agent, and under what terms?
Assurance
- Which of the OWASP ASI Top 10 do your controls address, and which do you consider our responsibility?
- What independent assessment has been performed specifically on the agentic components?