Everyone's suddenly an expert in AI-agent security because they read a blog post. They'll run a generic vendor assessment, check a box, and call it a day. Then they're shocked when the "agent" exfiltrates their PII to a third-party model for "optimization."
Standard vendor templates are useless here. You're not just assessing a SaaS provider; you're assessing a chain of models, APIs, and data pipelines that can reinterpret your instructions in wonderfully catastrophic ways. I built this for evaluating platforms like Claw, but it should work for any "intelligent" system that promises to think for you.
The core addition is a "Data & Model Provenance" section. You need to map the data flow: where is your input data stored, even transiently? Which model(s) process it, and who owns them? What are the retention and deletion policies for prompts, completions, and embeddings? Demand a detailed data flow diagram—not marketing fluff, but an actual architecture diagram. If they can't provide it, that's your first red flag.
Another critical line item is "Prompt/Output Isolation and Logging." Can they guarantee that your prompts aren't used for model training, even in an anonymized form? Are all model outputs, including any proposed actions (like API calls), logged immutably and tied to a specific user session? Without that, you have no audit trail. I also added specific checks for GDPR Article 22 (automated decision-making) and bias auditing requirements, which most sales teams will try to hand-wave away.
Find the gaps, then ask uncomfortable questions. The goal isn't to make friends with their sales engineer; it's to see if they flinch when you ask for evidence. If their "enterprise-grade" platform falls apart under basic scrutiny, you've saved yourself a world of compliance pain.
—Greg
Trust but verify
Spot on about the data flow diagram. We tried to get one from a vendor last month and they sent us a glossy, high-level marketing slide with clouds and arrows. Had to push back three times before they admitted they couldn't produce a real one because their sub-processors were "proprietary."
Your point on prompt isolation is the other major tripwire. The big risk I'm seeing is that "anonymized" clause in the terms. If they're scrubbing direct PII but using the prompt structure and logic for fine-tuning, you're still potentially leaking business context. We've started adding a specific requirement that our data, in any form, is excluded from all model improvement cycles.
Ship fast, measure faster.