Seven questions that come up when AI agent security moves from a slide to a questionnaire, and the evidence that answers each one.
Your security review will ask where the agent platform runs, what each agent is allowed to reach, and whether you can prove afterward what an agent did. Most of AI agent security, once it reaches procurement, covers the same ground as any system that holds credentials and touches customer data: identity, data location and records.
If you're the engineer or buyer who has to answer the questionnaire, these are the seven questions to prepare for, with the evidence a reviewer will accept.
1. Where does it run, and where does our data go?
Expect this first. The reviewer wants a diagram showing which components run in your account, which run in the vendor's, and which third parties see your prompts and tool outputs. Bring the vendor's list of deployment models. Catalyst, for example, runs as a shared cloud, as a single-tenant dedicated cloud, inside your own cloud account (BYOC, managed or self-managed), or air-gapped with no connection back to Diagrid. When the data plane sits in your own account, the questions about vendor access get much shorter answers.
2. What identity does each agent have?
A shared API key is the wrong answer. Reviewers want each agent, MCP server and service to carry its own identity, so one can be revoked without breaking the others. Workload identity based on SPIFFE, issued and rotated by the platform, holds up well here. For the identity questions a CISO will push hardest on, this list goes deeper: 8 questions CISOs ask about AI agent security.
3. What is each agent allowed to call?
Expect to show the actual policy file. The strong answer is deny by default, with grants per tool rather than per server, so an agent allowed to read GitHub issues can't delete a branch on the same server.
4. Where do the credentials live?
If the keys for your tools sit in environment variables next to the agent code, the reviewer will flag it. The platform should hold them as managed secrets and use them on the agent's behalf, so neither the agent code nor the model ever sees them.
5. What gets recorded, and for how long?
Reviewers ask for the audit trail of one real run: every model call and tool call, with inputs and outputs, in order. Then they ask about retention, because your records policy and your database budget rarely agree. Look for a platform that archives run history to long-term storage, checks the archive is complete, and only then lets you purge. Signed steps go further, since anyone with the public key can check that nobody edited the record.
6. How do we stop a run safely?
Killing a process halfway through a write leaves half a transaction behind. Ask how an operator pauses or terminates a run and what state it leaves. A workflow engine can suspend, resume or terminate a run from its recorded history, which gives the reviewer a written procedure instead of "we'd scale the deployment to zero."
7. What can the vendor see, and what's certified?
Ask who at the vendor can access your run history and prompts, through what process, and request the SOC 2 Type II report under NDA. Diagrid is SOC 2 Type II certified. Check the report date on any vendor you evaluate.
Before the meeting
Take the platform's documentation, answer all seven in writing with a link to the evidence for each, and send it to the reviewer a few days ahead. Then the meeting can spend its hour on the answers you couldn't give.
Top comments (0)