The vendor question card
One question to ask every agent-platform vendor, asked identically each time, and the four answers you will get.
Why it exists
Ask it exactly the same way each time. The value is not that the question is clever — it is that asking it identically makes the answers comparable across vendors, and the comparison is the finding. And ask it of yourself first: every question here applies to systems you have already built. If your own answer is the architecture diagram, the vendor's architecture diagram is not disqualifying, it is the industry.
What it contains
The single question, phrased for repetition rather than for cleverness
Two clarifications to have ready, because you will be asked for them
The four answers, and what each one actually tells you
Four follow-ups that escalate cleanly whatever the first answer was
Why using this as a gotcha costs you the information you came for
No email required, and nothing is recorded when you download. Use it, adapt it, argue with it — attribution is welcome, not a condition.
The question
Then stop talking. Clarifications to have ready: 'Not the dashboard, and not the architecture — one action, and its authority record.' And: 'A real day, not a demo tenant.'
| Ask this, verbatim, every time |
|---|
| Pick a Tuesday. Last Tuesday. Show me one action your agent took that day — and everything you would hand a regulator who asked why it was allowed. |
The four answers
| Answer | What it tells you | The follow-up |
|---|---|---|
| They show the observability product — traces, spans, a timeline, possibly very good. | They have telemetry and are treating it as evidence. Telemetry records what happened; an authority record states what was permitted and by whom, and it has to exist at the moment of the action rather than be reconstructed afterward. | Does any line in that trace say what the human agreed to, or only what the system did afterward? |
| They explain the design — roles, policies, a permissions model, possibly a well-built one. | The control exists in the design. Whether it produced a record for that specific Tuesday is a separate and unanswered question. Design is a claim about the general case; you asked for one instance. | I believe the design. I am asking what it emitted on Tuesday. Can you retrieve it? |
| They say the record does not exist in the form you are asking for. | More than the other three. You now know the true state, you know it before signing, and you are talking to someone who will tell you an inconvenient thing. Treat it as a positive signal about the relationship. | What would it take, on your side and mine, and would it be in the product or in my integration? |
| They hand you the record. Rare — it happens. | The product was built to be examined, which is a deliberate and expensive choice somebody made early. A record that exists can still fail to name a principal, an action, a boundary or an expiry. | Score it with the approval-record scoring worksheet, in the room, while you have their attention. |
The four follow-ups, in order
The same every time, whatever the first answer was.
| Ask | What you are looking for |
|---|---|
| Who is the agent, to the system, at the moment it acts? | A principal — not an account, not a role. |
| What were the edges of what was approved? | A stated boundary, not the presence of assent. |
| If I revoked it right now, what still lands? | Whether anyone has measured it. 'Immediately' means nobody has. |
| Could you answer question one about a call from six months ago? | Retention that survives credential rotation. |
How to use it
- Print it. Take it into the room. Ask the question in exactly the same words at every vendor meeting.
- Record the answer type alongside whether a principal was named, a boundary stated, revocation measured, and six-month retention demonstrated.
- Say out loud that this is not a gotcha. A vendor who cannot answer may be selling something that was never built to be examined — a fact about the product, legitimate to weigh, and not a verdict on the company or the people in the room.
- Ask it of yourself before you ask it of anyone else.
- Do not treat the answers as a ranking. They are a comparison of what each product can produce, which is a narrower and more useful claim.
Built from public standards and general practice. The instruments cited in this artifact are checked against their primary sources on an ongoing basis. Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
Related: the other artifacts · the diagnostic.
Want this applied to your estate?
These artifacts are general by design — and they are the method behind the Agent Estate Review: two to three weeks establishing what is actually running, what each thing is permitted to do, and where you could not evidence it if you were asked next week. You have just read how it works.