Guide
12 min read
The security reviewer's guide to AI agents
The questions to ask any agent vendor about data, permissions and logging, with what a good answer sounds like.
Most vendor questionnaires were written before agents could take actions. This guide adds the questions they miss.
Data
Ask where data is stored, how long it is kept, and whether it is used for training. Ask for the answer in the contract, not only on a web page.
Actions
Ask what the agent can do without a person, how that is limited, and how you would find out if it did something unexpected.
Keep reading
Post
6 min read
What a good approval step looks like
Approval only protects you if the reviewer can see what the agent did and why. Here is what to show them.
Post
5 min read
Four weeks from first call to first approved task
The rollout plan we use with most teams, week by week, including who needs to be in the room.
Post
4 min read
Why we start every connection read-only
Read-only is slower for a week and safer for a year. Here is the reasoning behind our default.