Agent Vendor Due Diligence

Definition

Agent vendor due diligence is a proportionate review of a third party’s service, contracts, controls, dependencies, and operating practices before and during its use in an agent workflow.

Review the service you will actually use, including its enabled connectors and customer configuration. A general vendor reputation does not tell you whether a particular integration is appropriate for the intended data and actions.

What it covers

Service scope

Identify the agent, tools, subprocessors, and operator.

Data and authority

Review retained data, permitted uses, identities, and access.

Evidence

Check controls, evaluations, incident terms, and audit information.

Lifecycle

Plan changes, renewals, termination, and data return or deletion.

Separate supplier obligations from customer responsibilities. The vendor may secure the platform while the customer chooses broad permissions or exposes the wrong data. Document who configures identity, approves tools, monitors use, and responds to incidents.

In practice

Practical design patterns by Min.

• Start from the proposed workflow and data, not a universal questionnaire.
• Ask which controls the customer must configure or operate.
• Record notification and review expectations for material changes.
• Define how to revoke access and migrate or retire the integration.

Maintain a concise decision record linking use case, evidence reviewed, limitations, owner, approved scope, and review date. Questions should be proportional to the consequences and the ability to reverse actions. Follow material control claims to evidence where available.

Working example

Why the controls matter

The support agent may be approved initially for case reading and drafting. Enabling customer-record writes later is a scope change even if the vendor and commercial contract remain the same.

Common pitfalls

• Treating the vendor’s model benchmark as evidence for the whole workflow.
• Reading a security certificate as covering every new agent capability.
• Leaving permissions and data-return obligations unresolved at contract renewal.

A completed onboarding review can age as the service changes. Renewal, new subprocessors, changed data use, incident findings, or new tool authority can require renewed examination rather than automatic continuation.

Questions for operational review

Use these questions to decide what evidence your team needs. They are editorial prompts, not a compliance checklist.

• What does the reviewed evidence actually cover?
• Which controls belong to the customer?
• Can access and data be withdrawn at exit?