When an AI vendor claims its agent can handle supplier onboarding, the scope of “handle” needs to be defined. Reading documents and recommending a decision, creating the supplier record, and approving a supplier for business are distinct actions. Each carries different commitments and consequences for the enterprise.
A demonstration may present the work as straightforward. In practice, complications arise when documents conflict, approvals are missing, or updates reach the wrong record. The organization must define what the agent is permitted to do, what should prevent it from acting, and who is accountable when the work cannot be completed.
For a leader evaluating the offer, I would organize the decision around three questions:
- What outcome are we buying?
- What evidence supports the vendor’s claims under our operating conditions?
- Can we manage the service, its costs, and its failures after launch?
The answers should shape the purchase. They may support a deployment, justify a narrower pilot, or expose a gap that needs resolving before any commitment. Using a supplier-onboarding proposal, we will work through the evidence a leader should ask for and how it changes the buying decision.
Quick brief
Define the service you are buying before judging the demonstration. Preparing an assessment, creating a record and activating a supplier carry different responsibilities.
Ask for evidence about the configured workflow, including the permitted path, denied actions and recovery. A missing critical control can prevent a wider deployment while leaving room to investigate a narrower service.
Make the operating owner, complete cost, change obligations and exit arrangements part of the purchase. In the worked example below, the evidence supports negotiating a read-only pilot, not buying end-to-end automation.
Audio and video summary
Read the summary transcript
Welcome to ajithp.com. We’re looking at three questions to ask before buying an AI agent.
When an AI vendor offers to handle supplier onboarding, define what the service will actually do. Reading documents, creating a supplier record and activating a supplier are different responsibilities. The purchase should follow three questions.
First, what outcome are we buying? If the delay comes from preparing assessments, faster document reading may help. If completed assessments wait for approval, the bottleneck remains. Decide which actions the agent may take, which remain with employees, and what a useful handoff looks like when evidence is missing.
Second, what evidence supports the offer under our operating conditions? Follow representative cases through the configured service. Check the company, the source documents, the permissions and the actual result in the procurement application. A conversation saying record created is a claim to verify.
Consider an approval issued for Supplier B while the agent is working on Supplier A. The expected result is that Supplier A stays pending and activation is rejected. Then test the permitted counterpart, so legitimate work can still succeed. The executing system must check the approval, rather than rely on the agent’s assertion that permission exists.
Now interrupt the return connection after an authorized activation. A timeout does not establish whether the change committed. The integration needs to reconcile the destination before deciding whether another attempt is safe. If the state cannot be resolved, an accountable person needs to handle the exception.
Third, can we manage the service, its costs and its failures after launch? Establish who receives unfinished cases, investigates incidents, suspends work and approves material changes. Include model providers, external services, support access and geographic exposure in the assessment. Hosting region alone does not settle privacy or regulatory requirements.
The article uses a hypothetical offer, not a real vendor evaluation. At 1,000 assessments a month, 12 minutes of existing employee effort at $60 an hour represents $12,000 of capacity. Five minutes of retained assessment work, a $6,000 vendor fee and $1,500 of additional checks and support produce a modeled monthly total of $12,500, before integration. Faster work does not automatically mean lower cost or cash savings.
On the example’s incomplete evidence, activation remains excluded. Procurement can negotiate a smaller read-only trial with synthetic documents, clear limits and an end date. That trial tests feasibility. Production economics still require comparable real-work evidence and the necessary approvals.
The full article and fillable evaluation workbook connect the supplier’s claims to evidence, remaining gaps, owners and a decision about the scope that may proceed.
Read the full analysis and use the evaluation workbook at ajithp.com. Thanks for joining us.
1. What outcome are we buying?
“Automate supplier onboarding” leaves too much open for the buyer and vendor to agree on what they’re buying. One vendor might mean reading documents and drafting an assessment. Another might include creating the supplier record, requesting missing information, and activating the account. Before comparing their offers or writing acceptance terms into a contract, the buyer needs to know how much work and responsibility each service would take on.
Start with the delay you are trying to remove. If employees spend hours interpreting varied document packs, an agent may help them prepare assessments. If completed assessments wait days for an authorized approver, faster document reading will leave that queue in place. I would want the investment case to show which of these problems the purchase is expected to solve.
That also helps decide how much of the process to give the agent. The existing application may already handle required fields, approval routing, and record creation adequately. An agent could interpret the documents while those controls continue to run in the application. The buyer can then evaluate the new capability without also replacing parts of the process that already work.
Decide what the agent is allowed to do
Suppose a vendor offers “end-to-end supplier onboarding” for $6,000 a month, covering up to 1,000 cases. The service would read the documents, draft an assessment, create a pending record, and activate the supplier after approval. This is a hypothetical proposal; its price and the findings below are illustrative.
Procurement’s problem is narrower than the offer. Staff spend too long preparing assessments, and missing or conflicting evidence must reach an employee while the issue remains open for them to decide. Activation would help only if the vendor can demonstrate adequate approval and recovery controls. Payment changes, purchase commitments, and external messages are out of scope. Procurement is working to improve the assessment, while the $6,000 quote also includes record creation and activation.
If the buyer includes activation, a separately authenticated, authorized person must approve the action for the relevant company. The agent cannot grant that approval to itself. This requirement must be reflected in the configuration, integration, and vendor agreement so it holds when someone uses the service, including when the agent requests an action it should not take.
For an assessment service, leaving a case pending because evidence is missing can be the correct result. Procurement should receive the assessment, its supporting sources, the unresolved issue, and a clear account of what an employee still needs to do. A message saying “human review needed” leaves too much for that employee to reconstruct. The acceptance terms should describe this handoff separately from the requirements for activating a supplier.
A purchase can gain scope through a sequence of small approvals. An evaluation gets access to the supplier master, then a verification service, then a write path for pending records. Each connection may seem reasonable, but together the services gain more authority than anyone intended. Paying for an evaluation, signing a contract, starting a supervised pilot, and allowing production actions are separate decisions. The agreement may cover some of them, but each new connection should be covered by an explicit decision about its scope.
Where the data goes, and who can access it
Decide which countries, languages, and supplier types the service is expected to handle. A service evaluated on routine suppliers in one country may face different documents and obligations when another business unit adopts it. The vendor needs that scope to prepare its offer; the buyer needs it to recognize cases the evaluation has not covered.
Data may travel farther than users expect. Documents or information extracted from them may reach a model provider, an external verification service, an operational log or a support team. Ask the vendor to show those flows, including derived information, backups and the legal entities providing the services. The region selected for the main database tells you only part of that story.
The UK Information Commissioner’s Office illustrates the problem with a separate overseas IT-support company accessing personal information on a UK company’s servers. Its three-part test asks whether UK GDPR applies to the processing, whether information is transferred or made accessible to an overseas recipient, and whether that recipient is a separate legal entity. Access can be a restricted transfer even when the information remains on the UK server. The vendor’s support arrangements therefore belong in a UK transfer assessment alongside its hosting region. ICO guidance on restricted transfers
A general “compliant” label leaves legal, privacy, security, and sector owners to assess the actual use, affected people, and access arrangements. Under the European Commission’s AI Act guidance, responsibilities depend on the risk and on the party’s role as provider or deployer. Agentic software is not automatically high-risk, and a lower-risk classification does not answer every legal or privacy question about its use. The assessment should identify which obligations apply to this purchase. European Commission: navigating the AI Act
Ask the relevant owners to turn their assessment into requirements the vendor can answer. Establish who processes the information and for what purpose, what may be retained or used for training, and which subprocessors, support personnel, and destinations may receive it. Identify any required disclosures, oversight, and ways to correct an outcome. Where the process requires a current document or an approval, specify how the delivered service will enforce that requirement.
As sponsor, I would ask the legal, privacy and security owners for their conclusions, the assumptions behind them and any conditions that prevent the proposed use. They bring the specialist judgment. The purchase decision must account for their findings. A pilot with synthetic documents may help assess capability while those questions are resolved, but it does not authorize processing the real documents intended for production.
With the scope settled, the vendor can demonstrate the service against the cases, permissions, and restrictions the business intends to give it.
2. What evidence supports the vendor’s claims under our operating conditions?
A model benchmark can help assess capability under its test conditions. The onboarding service adds the vendor’s document handling, retrieval, tools, permissions, and rules for unfinished work. Check which of those the cited evaluation actually covered. For the purchase decision, I want to see how the configured service handles our defined business process.
For this onboarding offer, follow a case through the proposed configuration. Confirm the assessment concerns the correct company, unresolved issues remain visible, and any action stays within the granted authority. Record the model version, instructions, retrieved sources, tools, routing, approval rules, and surrounding software used in the evaluation. If these change, the earlier result may no longer describe the service being delivered.
The risk grows as the service gains permission to act. A reviewer may catch an incorrect recommendation before it goes further. If the service writes that recommendation into a shared record, triggers another workflow, or repeats the error across many cases, the business may have to trace and repair the consequences. That work can consume the capacity the purchase was supposed to release. An immature service can leave employees with more checking and unresolved work, particularly when they cannot establish how a record changed.
When the agent’s transcript says “record created,” treat that as a claim to check in the procurement application. Anthropic’s guidance on agent evaluations distinguishes an agent’s activity transcript from the outcome in its environment. In this case, the evidence is the correct supplier record and the action history showing what changed. Read the answer, then check whether the authorized result occurred and whether the service attempted or made an unauthorized change. Anthropic: demystifying evaluations for AI agents
Test the work the service will receive
A useful acceptance exercise includes work that should finish and work that should stop. The process owner and vendor agree the expected result for each case before choosing ordinary packs, incomplete documents, conflicting evidence, and the languages and supplier types in scope. A service that completes every case may simply be ignoring uncertainty. Correct escalations and denied actions belong among the expected results.
Run the evaluation in a suitable environment with the identities and permissions intended for deployment. A demonstration using administrator access may conceal a dependency on permissions the enterprise will never grant. Establish which identity reads a document, invokes an external tool, and writes the destination record. Enforce required access restrictions where they apply.
Hold back some cases from the material used to tune the demonstration, while keeping the requirements clear to the vendor. Repeat cases whose results may change between model runs and retain the conditions that produced them. Otherwise, a favorable run can conceal variation that employees will encounter later.
Review results for difficult cases separately from the overall average. A service that performs well on common documents may repeatedly struggle with a particular language or less common supplier type. Before accepting it, decide whether to exclude those cases, escalate them to employees, or leave them as an unresolved weakness in the offer.
If the vendor uses a second agent to review the assessment, include that reviewer in the evaluation. Two agents can agree because both relied on the same incorrect document. Useful questions are what the reviewer can inspect and whether its judgments hold up against a competent human assessment. Where a destination record or authoritative source settles the issue, inspect it directly. The vendor need not disclose its proprietary implementation to demonstrate the outcome.
Check what happens when an approval is wrong
Suppose activation is part of the proposed service, subject to human approval. A useful evaluation case would give the service Supplier A’s documents and an approval issued for Supplier B. The expected result is straightforward: Supplier A remains pending, activation is rejected, and the mismatch is made visible to the responsible employee.
Ask the vendor to show the rejected activation in the procurement application and its action history. Then ask which control rejected it. Telling the model to check an approval may influence its behavior, but the system executing the action must also reject the request if the model asks to activate the wrong supplier.
Then run the permitted counterpart. The right authorized person approves the relevant action for Supplier A, and the service should complete that action correctly. Refusing every activation would pass a refusal-only test while failing to deliver the purchased capability.
Behind the Supplier A test sits a requirement for the executing system to check the approval against a trusted approval record or validated artifact, rather than accept the agent’s assertion that permission exists. The approval must cover the supplier, action, and case version, and remain valid when used. Expiry, revocation, or materially changed evidence may require renewed approval under the agreed policy. Where separation of duties applies, the requester cannot approve their own case. Each of these properties belongs in the requirements and the test, because an approval button alone establishes none of them.
The permitted and mismatched cases show what “human approval” means in this service: what it allows, what it prevents, and whether legitimate work can still succeed.
Check what happens when the connection fails
For a second case, interrupt the return connection after the procurement system commits an authorized activation. The agent times out even though Supplier A may already be active. Ask the vendor to show how the service establishes what happened before it decides whether to try again.
An immediate retry assumes the first request failed, but the timeout doesn’t prove that. Depending on the destination, another attempt may be rejected, recognized as a duplicate, or applied again. The vendor should demonstrate how this integration handles those possibilities. Where idempotency is supported, repeated attempts can be recognized as the same operation within its defined scope and lifetime. Once that protection expires, the service may treat a retry as a new request. Duplicate protection does not replace authorization.
Before attempting another action, the service must establish what committed. Test the other branch too: when the first request never committed, the service should complete it once under a still-valid approval. A temporarily incomplete lookup is not proof that no write happened. If the approval expires while the outcome is being reconciled, the service must not use it for a new activation. If it cannot safely establish an outcome, it belongs in a controlled exception with an owner who can resolve the state and obtain any fresh authority required.
An unavailable verification service creates a different kind of unfinished work. Exhausting retries does not complete the check. Either an approved fallback finishes it, or the missing requirement goes into the employee’s handoff with the evidence already gathered.
Supplier documents can also contain text written to look like instructions. Imagine a certificate telling the agent to mark the company verified or send the document pack to an outside address. Reading that text gives it no authority to do either. Test whether the service enforces permitted destinations and actions when it encounters such an input. The NeurIPS 2024 AgentDojo paper evaluates tool-using agents with untrusted data and examines useful task completion and security outcomes separately. Those results concern the paper’s environments, models, and attacks, not this vendor’s failure rate. The useful purchasing lesson is to evaluate legitimate work and adversarial inputs separately, so a capability score or security label cannot stand in for the other. AgentDojo paper
The results make the vendor’s claims easier to judge, provided the report keeps the conditions and uncertainty attached to each finding. Passing a few controlled cases cannot establish that harm is impossible. A deliberately induced failure also cannot tell you how often the service would fail in normal use.
There is a limit to how much evidence it makes sense to demand before a small, read-only trial. Requiring full production assurance at that stage could prevent the business from learning whether the assessment service is useful. Agree appropriate data, permissions, supervision, an end date and decision criteria for the pilot. Keep activation unavailable while its authority and recovery controls remain unverified.
My decision on the onboarding offer
In our hypothetical record, the ordinary assessment can be traced to the correct company and supporting documents in the test environment. That supports the demonstrated case and configuration. The evaluation still has to cover the other documents and languages the business expects.
Two claims remain unverified. The vendor has not shown that the system will reject an approval for Supplier B when the activation concerns Supplier A. For the lost-confirmation case, it provides an action trace but does not establish whether the procurement system committed the change. The record says “not verified” because the evidence is absent, not because anyone ran those tests and observed a failure.
I would not authorize activation on that evidence. The assessment service may still be worth examining with production credentials and write paths unavailable. The vendor can protect its source code and proprietary prompts while demonstrating the customer-facing action boundary and outcome. That gives procurement something specific to ask for without demanding the vendor’s intellectual property.
The next discussion is about a separately priced, time-limited assessment pilot, with evidence access, no annual commitment and no automatic expansion into activation. The vendor may refuse to unbundle the offer or insist on a long minimum term. In that case I would defer the purchase rather than pay for the unsupported parts of the service.
3. Can we manage the service, its costs and its failures after launch?
Even after the service passes its evaluation, someone has to run it on a normal workday. Before signing, I would want to know what employees will do when a case is incomplete, an incident occurs or the vendor changes a dependency. The agreement needs to cover that work as well as the capability demonstrated in the test.
An escalation queue costs money even when every escalation is correct. Employees receiving it need the conflicting evidence, work already performed, the current destination record, and a decision still required. Without enough capacity and expertise to resolve those cases, the service can shift the bottleneck rather than remove it. An approval count does not show whether people had time and information to review the work properly.
Ask the vendor to investigate a case
In the lost-confirmation example, operations needs to identify the affected supplier and establish whether activation occurred. An uptime dashboard or a count of successful API responses cannot supply that answer on its own. The team needs to connect the case to the relevant sources, configuration, approvals, attempted actions, and actual effects on the destination.
Ask the vendor to take one case through an investigation. You should be able to distinguish what the service attempted, what was verified in the destination, and what remains uncertain. Include external calls, retries, employee interventions, and costs. The team needs this record of observable work to investigate an incident; it does not need access to a model’s private reasoning. Agree on access, redaction, and retention limits so logs don’t become an unnecessary store of sensitive documents.
Monitoring needs to expose problems with the work as well as outages. A service can remain online while producing incorrect recommendations, escalating an unusual number of cases or repeatedly failing to reconcile changes. Different incoming documents can also require attention. Ask the vendor to demonstrate an alert reaching someone with authority to intervene, then show what that person can do.
Suspending new actions is only part of containment. Queued work, scheduled runs, and calls already in flight may need separate treatment. Some effects cannot be canceled, and stopping the software won’t fix an incorrect record or retract an external commitment. The operating arrangement needs a way to reconcile those effects and continue essential work manually.
NIST’s AI Risk Management Framework connects this operating discussion to defined responsibilities, ongoing monitoring, and third-party risk management. Look for those responsibilities in the vendor agreement and in the enterprise’s arrangements for running the service. The framework gives the parties a reference for that work; the investigation and intervention exercises establish what this service can actually do. NIST AI RMF Core
Agree who owns the service and its changes
A vendor can change model routing, instructions, retrieval sources, or tools without substantially changing the interface. An evaluation of the previous configuration may no longer describe the service employees are using. New subprocessors or support arrangements can also affect the privacy and geographic assessment.
Agree which changes require notification, regression evidence, or renewed authorization, and retain the accepted configuration and test record where feasible. If the vendor cannot hold a version, ask how it will qualify a replacement and what happens if performance deteriorates. Routine maintenance should not require an executive meeting. Changes that invalidate an approval, privacy assumption or accepted behavior need an accountable decision.
Responsibility should be clear on both sides of the contract. Within the enterprise, name the business outcome owner, operating owner, exception owner and decision maker. The vendor’s commitments should cover service levels, incident evidence, notification, investigation, remediation and support. Technical and commercial owners need to reconcile those commitments before an incident leaves each party expecting the other to act.
Expansion changes the assumptions behind the accepted service. Additional countries, languages, supplier types or actions may require new evidence and assessment by the control owners. A successful first business unit does not establish readiness for every proposed use.
Exit deserves attention while it is still negotiable. Confirm whether records, linked evidence, relevant operating history, and open cases can be exported in a usable format. Test a useful export. Agree transition support and charges, how unfinished onboarding would continue, and which party retains or deletes which information under the relevant obligations. An agent service can be hard to replace because of its accumulated state and integration dependencies, even when the model itself is replaceable.
Work out what it will cost to run
Use comparable assessment work for the cost calculation. Suppose the current process handles 1,000 cases a month, with preparation and checking taking 12 minutes of employee time per case at a loaded $60 an hour. That values the assessment effort at $12,000 a month. Record creation, activation and costs common to both processes are excluded from both sides. The forecast allows five minutes of retained assessment work per case, including review and the average effort to handle errors and exceptions, at $5,000 a month. Add the full quoted vendor fee of $6,000, an assumed $500 in additional verification-service charges and $1,000 in additional operating-support charges. The modeled monthly total is $12,500 before one-time integration and transition costs.
That is $500 a month above the current assessment cost. At the full quoted fee and other costs, retained assessment effort must fall below 4.5 minutes per case to beat the $12,000 baseline before one-time costs. At the forecast five minutes, the vendor fee would have to fall below $5,500 instead. We haven’t priced the narrower assessment-only service; the full-service quote is a comparison to challenge, not the agreed production price. The current-process baseline and the review forecast both need measurement on comparable work, including errors, exceptions and unfinished cases. A synthetic-data trial alone will not establish those figures.
The loaded hourly rate values capacity that employees could use elsewhere. Payroll and cash spending may remain unchanged, so the investment case should state whether it buys capacity, reduces expenditure, or improves service. Faster turnaround or better quality could justify a higher modeled cost, with evidence of those benefits and an explicit investment decision. On the figures above, I would not present this offer as a demonstrated labor-cost saving. Procurement needs a different price or a different, supported reason to buy it.
The price discussion also needs a clear billable unit. An escalated, pending, or retried case may count against the quoted allowance even though onboarding is unfinished. At 1,000 cases the example is already at the tier ceiling, making overage terms important. Alongside the service fee, account for implementation, integration, model and evaluator calls, retrieval, external verification, routing, retries, monitoring, human review, support and rework. Separate one-time and ongoing costs over the decision period, including minimum commitments, support tiers and exit charges.
Measure turnaround time and employee effort separately. An agent may prepare an assessment quickly, only for it to wait days for approval. A case may also finish sooner because employees spend more time checking it. Return to the original investment case and show whether the proposed service improves the delay or effort the buyer set out to address.
Report correct completions, correct escalations, correct refusals and errors separately. If the purchased outcome is a prepared assessment, measure its quality and cost as an assessment. Calling a pending record “completed onboarding” understates the remaining work and makes the service look more economical than the evidence supports.
The acceptance exercise deliberately includes difficult and prohibited cases. Its aggregate cost is not an operating forecast. Use an expected production mix or suitable pilot evidence for that forecast, and examine sensitivity to volume, exceptions, external-service charges and vendor pricing. The AI cost workbook offers a starting point for separating model calls, external services and other workflow costs.
Unresolved activation controls still limit the purchase, regardless of what the average cost suggests. Procurement can negotiate assessment preparation while employees retain activation, but the contract, price and operating decision must describe that smaller service. Its economics depend on the price actually offered and the work employees still perform.
Put the pilot terms in writing
For this proposal, I would defer the full purchase and ask procurement to negotiate a narrower pilot. I would not give the service production access on the evidence described above. Negotiating the terms and authorizing the pilot to start remain separate decisions.
My counteroffer would be a ten-business-day, read-only assessment trial with a $1,000 total fee ceiling including support, no annual minimum and no automatic renewal into production. It would use approved synthetic examples in an isolated environment. These are proposed terms in the hypothetical negotiation; the vendor has not accepted them. I would also ask for indicative production pricing for the narrower scope and the right to stop without a further commitment if the price or evidence is unsatisfactory.
Before starting, the process owner and vendor agree the case count and mix, expected assessment quality, source checks, exception handling and the evidence to retain. A small trial may establish feasibility without supporting estimates across every supplier type. The technical owner verifies that production credentials and prohibited write paths are unavailable and that outbound destinations are restricted; read-only access does not prevent disclosure through a model call, external service or log. The agreement also covers using inputs and outputs for training, output rights, and retention and deletion. An operating owner must be able to suspend work, obtain the evidence, and export the output.
At the end of this synthetic-data trial, the decision is whether the assessment service is promising enough to investigate further. Production economics remain open. If the business wants to proceed, it needs a separately approved assessment-only evaluation on representative real documents, with the required privacy, security, and business permissions. The process owner measures the existing assessment baseline and retained employee effort on comparable work; the vendor confirms the scope and price. The named decision maker can then consider a production proposal or stop. Activation stays excluded: the vendor must demonstrate approval enforcement and both recovery branches in a separate controlled test environment, with the technical owner checking the results, before any later request for activation authority.
Record the decision with the accepted configuration, remaining blockers, residual risks accepted within scope, owners, and retest conditions. That gives procurement a service to describe in the agreement and a scope to implement. If the vendor rejects the counteroffer or cannot meet the conditions to start, the pilot does not begin.
Download the evaluation workbook
The workbook records the hypothetical buying decision and cost comparison, then provides fillable pages for your scope, evidence, test cases, and decision. It links each claim to what you checked, the remaining gap, its owner, and its effect on the purchase. It provides no automatic calculation or readiness score.
Download the AI supplier evaluation workbook (fillable PDF, 6 pages)
Related reading
- Making human oversight work for AI agents examines whether the reviewer has the evidence, authority, and working conditions needed to influence the outcome.
- AI token economics works through the cost of accepted results and provides an editable workflow-cost model.
- Enterprise AI in 2027 connects the purchase to wider decisions about operating ownership, context, model choice and human judgment.
Frequently asked questions
What should a CXO ask before buying an AI agent?
Establish the business outcome, the evidence supporting the vendor’s claims under the intended operating conditions, and the ability to manage the service after launch. The level of assurance should match the commitment: an investigation, procurement agreement, supervised pilot, and production authorization are different decisions.
Is a strong model benchmark enough to approve a vendor’s service?
No. It describes what was evaluated under its test conditions. The purchased service also depends on context, tools, permissions, workflow logic, persistent state, and external services. Evaluate the configured service on representative work, and check the outcome in the destination application.
How does geographic exposure affect the purchase?
Assess where the service operates, who it affects, the participating legal entities, and where information is processed or accessible. Include model providers, tools, logs, backups, and support. Relevant legal and privacy owners should determine the requirements for the actual arrangement. Hosting region alone does not settle them.
Do all AI agents have the same compliance obligations?
No. Applicable requirements depend on the jurisdiction, intended use, and relevant roles. A vendor’s general compliance statement does not replace the customer’s use-specific assessment. Record its assumptions, required controls, and the changes that would require reassessment.
What should observability let the business do?
Find an affected case, establish what the service attempted and what actually happened, and support investigation and intervention. Evidence should connect sources, configuration, approvals, actions, destination effects, and unresolved work, with appropriate access and retention limits. Private model reasoning is not required.
Can a pilot start before every question is resolved?
Yes, if its scope, data, permissions, and supervision control the relevant exposure and meet applicable requirements. Give it learning objectives, an end date, and an accountable decision maker. Keep unverified consequential actions disabled. A read-only pilot does not establish that production writes or recovery work correctly.
Who decides whether the agent can go live?
The enterprise’s named decision maker authorizes its operating scope using assessments from the business, technical, and relevant control owners. The vendor remains responsible for its agreed obligations. Its readiness claim is evidence to examine, not authorization to exercise the customer’s business authority.
When should the service be evaluated again?
When changes or failures can affect the accepted behavior or its assumptions. Relevant changes include models, routing, instructions, tools, permissions, data sources, approval logic, subprocessors and operating geography. Agree notification and proportionate retesting requirements before launch.
References and further reading
- Information Commissioner’s Office. Are we making a restricted transfer? UK applicability, overseas access and separate-entity test.
- European Commission. Navigating the AI Act. Risk-based approach and relevant provider/deployer responsibilities.
- Anthropic. Demystifying evals for AI agents. Published 9 January 2026. Distinguishes activity transcripts from environmental outcomes and discusses checking graders against human judgment.
- National Institute of Standards and Technology. AI Risk Management Framework Core. AI RMF 1.0 (2023), including ongoing risk management, responsibilities, and third-party risk. NIST states that an update is in progress.
- Debenedetti and colleagues. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. NeurIPS 2024. Evaluates task utility and security in tool-using environments with untrusted data.
- Ajith Vallath Prabhakar. AI token economics: what does a successful task actually cost? Related analysis and workflow-cost workbook.
External guidance checked on 22 October 2026. Assess applicability and contractual requirements for the actual purchase and operating scope.
Discover more from Ajith Vallath Prabhakar
Subscribe to get the latest posts sent to your email.