# AI agent governance procurement questions

Version 1.0 · October 13, 2026 · Published by AAES

Copy these questions into an RFP or technical evaluation for any implementation.
License: CC BY 4.0, https://creativecommons.org/licenses/by/4.0/.
Plain-text attribution to AAES is sufficient; no backlink is required.

For each response, request the supported version, configuration prerequisites,
known exclusions, evidence, and a demonstration in an agreed test environment.
Distinguish a roadmap statement from delivered behavior, and a vendor's internal
test from independent or customer-tenant evidence. Leave unanswered items open.

| Area | Question to ask | Evidence to request |
| --- | --- | --- |
| Boundary | Which exact routes and effects can you prevent, and which do you only observe? | Architecture and credential-path inventory; an alternate-route test. |
| Credentials | Can the agent retrieve a credential that bypasses the control? Who can rotate or revoke it? | Credential custody configuration and direct-call test. |
| Identity | How is the agent authenticated, and which person is accountable for its authority? | Identity verification, ownership, and tenant-isolation tests. |
| Scope | How do you restrict operation, resource, account, destination, and material arguments? | Negative tests for each supported scope dimension. |
| Approval | Is approval bound to the exact request? Who may approve, and when does approval expire? | Changed-request, self-approval, expiry, and revocation tests. |
| Spending | What does the budget meter? What is reserved before execution? Can concurrent requests exceed it? | Shared-ceiling concurrency test; reconciliation of reservations, effects, and charges. |
| Retries | What happens when the provider acts but the response is lost? | A controlled ambiguous-outcome test and documented retry procedure. |
| Outage | What happens if the control plane or decision store fails? Do old grants still work? | New-decision and existing-grant outage tests, with expiry bounds. |
| Evidence | Can we verify records without a vendor service? What is omitted from the export? | Export format, public verifier, key-provenance method, and tamper test. |
| Independence | Who controls signing keys, timestamps, and witness identities? | Separate trust material and an independence-required check. |
| Outcome | How are decisions matched to provider-confirmed effects? | Allowed, denied, failed, and uncertain-outcome reconciliation. |
| Recovery | What survives restore, rollback, migration, and termination? | Recovery test, checkpoint procedure, and retained export usability. |
| Integration | Which client profiles, transports, and provider operations were tested in live tenants? | Exact supported versions and distinction between local and tenant results. |
| Security | What independent assessments exist, what was their scope, and which findings remain open? | Dated reports and remediation evidence, where available. |
| Operations | Who owns availability, storage, key recovery, patching, and incident response? | Operating responsibilities and contractual service terms. |
| Data | Which data leaves our environment, how is it retained, and what subcontractors receive it? | Data-flow inventory, retention settings, and applicable agreements. |
| Commercial | What is metered, what may create extra charges, and how can we exit? | Written pricing definitions, limits, support scope, and termination procedure. |

Evaluation checklist: https://aaes.ai/evaluation-kit/agent-control-checklist.md

AAES is the author and a vendor in this category. These questions are not an
independent ranking, certification, legal opinion, or assertion that AAES or
another product meets every requirement. The final evaluation depends on the
buyer's workflow and evidence.