AI vendor assessment

Assess the agent or workflow, not the vendor as a whole. One sheet per agent.

What it does

1. Purpose and the workflows it runs
2. Inputs it reads, outputs it produces, actions it executes in which systems
3. Autonomy level as documented: assistance, copilot, action, workflow, autonomous
4. Human approval: where required, where optional, where absent

Control

1. Audit log of actions: exists, exportable, retention
2. Explainability: can a user see why an action was taken
3. Guardrails: limits, allow-lists, rollback

Data

1. Which of our data is sent to the model, and to whose model
2. Training on our data: yes/no, contractual basis
3. Data residency and retention

Evidence

1. Documentation links for 1 to 10
2. What we were able to verify ourselves, and how (demo, sandbox, reference)

Outcome

Fit for <use case>: yes / with conditions / no, with the evidence that decides it.