供应商安全审查代理

概览

价值

功能说明

• 先核范围

  一份覆盖的产品和你要买的那个不同的报告很常见、一文不值，而且写在一段没人读的话里。

• 找出例外事项

  每一份报告都有，而任何摘要都不会提。一份带四条例外的意见不是一份无保留意见。

• 核对报告期间是否够新

  一份在十四个月前就结束的报告，描述的可能是一家已经不再是那个样子的公司。

• 把次级处理者画出来

  你的数据接下来的旅程。通常是一个供应商可以不告诉你就改动的网页。

• 把宣称对照证据来检验

  问卷断言了某件报告从未测试过的事。那是能做的最有用的一项核对，也是最少被做的。

• 不批准任何东西

  它产出发现，以及该问的那些问题。接受一项风险属于那个要为它负责的人。

这会改变什么

运行方式

该智能体通过 PROMIVO 运行时在服务器端运行。每次运行都会逐步记录，每次工具调用在执行前都会进行权限检查。

1. 1输入按智能体的输入结构进行校验
2. 2模型claude-opus-5，并自动回退
3. 3工具search_knowledge, extract_structured_data
4. 4权限自动执行 READ 级操作；更高的等待你批准
5. 5输出符合输出结构的结构化结果
6. 6日志记录 token、耗时和每一个步骤

演示

演示数据Illustrative sample output, abridged.

{
  "vendor": "Northwind Analytics",
  "reviewDate": "2026-09-02",
  "serviceBeingBought": "Hosted reporting platform"
}

{
  "scope": {
    "note": "You are buying the hosted reporting platform. The report covers the data warehouse product only. Everything below applies to a system you are not purchasing.",
    "entityCovered": "Northwind Holdings Inc.",
    "productCovered": "Northwind Data Warehouse",
    "matchesServiceBought": false
  },
  "period": {
    "covers": "1 Jan 2025 – 31 Dec 2025",
    "current": false,
    "endedMonthsAgo": 20
  },
  "escalate": true,
  "disclaimer": "A reading of the documents supplied. No vendor system was tested or contacted, no approval or risk rating is given, and no statement is made that this vendor is secure or compliant. An untested claim is unverified rather than false.",
  "exceptions": [
    {
      "meaning": "The same control failure that would put your data in reach of someone who has left their company. Present in the detail; absent from the summary they sent.",
      "exception": "Two instances where access for departed personnel was not revoked within the stated period.",
      "affectsOurData": true
    }
  ],
  "subprocessors": [
    "A cloud hosting provider (US)",
    "A support ticketing provider (US)",
    "An email provider (EU)"
  ],
  "couldNotAssess": [
    "Incident response times — no evidence supplied and the report does not test them."
  ],
  "escalationReason": "The assurance report covers a different product than the one being bought, its period ended 20 months ago, and a questionnaire claim about subprocessor location is contradicted by the vendor's own published list.",
  "questionsToSendBack": [
    "Send the assurance report covering the hosted reporting platform, or confirm in writing that none exists.",
    "Confirm whether customer-managed keys are available on the reporting platform, and whether any assessment has tested it.",
    "Reconcile questionnaire item 6.1 with the two US subprocessors on your published list."
  ],
  "claimsVersusEvidence": [
    {
      "claim": "\"All customer data is encrypted at rest with customer-managed keys.\"",
      "source": "Questionnaire item 4.2. The report tests encryption at rest but says nothing about customer-managed keys.",
      "status": "asserted-but-untested"
    },
    {
      "claim": "\"We do not use subprocessors outside the EU.\"",
      "source": "Their published subprocessor list names two US-based providers.",
      "status": "contradicted"
    }
  ],
  "canAddSubprocessorsWithoutNotice": true
}

使用条件

使用场景

价格

常见问题

评价

客户运行过该智能体后，评价功能将开放。