Agent Vendor Due Diligence Checklist
An agent can't be careful about vendors — you have to be, in advance. This checklist makes it systematic.
The checklist
1. Reputation: who runs it, what's the track record?
2. Pricing model: per-call, per-token, subscription — and overage behavior.
3. Failure modes: what happens when their API errors? Does your agent retry?
4. Data handling: what do they receive, how long is it kept?
5. Worst-case spend: if your agent loops, what's the monthly damage?
6. Contract: cancellation terms, SLAs, support.
7. Offboarding: how fast can you stop paying?
Turning it into rules
Approved → allowlist with limits. Risky → conditional allowlist with caps. Unknown → not allowlisted.
FAQ
How deep should diligence go?
Proportional to spend — a $10/mo API gets a light pass; a major data vendor gets the full review.
Who maintains the list?
Procurement or the budget owner, with the allowlist as the enforcement point.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check