Risk without proportion is a list of reasons to do nothing
Supplier assessments produce findings. If the findings are disproportionate, they lead to paralysis. Every supplier has areas where they fall short. The issue is which of those gaps matter given what the supplier actually intends to do for you.
Someone who handles no personal data and someone who processes your customers' records should not get the same scrutiny from the same questionnaire score. A flat scoring system cannot show that.
Compensating controls are exactly what flat scoring fails to provide. A weakness that your own architecture makes irrelevant is not the same kind of weakness as one in a system that has direct access.
Business and legal decide whether the remaining risk is acceptable. The agent's job is to set out the position in a balanced way and to present both sides of the argument clearly, not to approve either side.
How the agent is built in Agent Studio
Prompt skills hold your criteria, the types of engagement you use, the data associated with each, and the access they provide, so a finding can be weighed against what the supplier can actually access.
The system prompt requires the agent to set out both the reasons for accepting the residual risk and the reasons against it. It prohibits a simple accept-or-reject decision.
It also prohibits any statement about a regulatory obligation, because legal advisers determine whether a supplier arrangement fulfills such an obligation.
The questionnaire assessment flow provides the structured answers to the Agent Chat node. An HTTP Request node adds public information about the supplier where you use it.
The assessment in Notion includes the findings, the extent to which the engagement applies, the compensating controls in place, and both arguments about residual risk.
Slack sends it to the person who makes the decision. Onboarding, approval, and contracting remain completely beyond the agent's control.
Assessments in Google Sheets mean that when a supplier is reassessed for a different engagement, the work starts from the previously recorded information.
What this agent is built from
- Prompt skills: hold your criteria plus engagement types, so findings can be weighed against real access.
- System prompt: argues both sides of residual risk. Produces no accept-or-reject verdict.
- System prompt: makes no statement about whether an arrangement satisfies any regulatory obligation.
- Agent Chat (Util): receives the structured questionnaire assessment.
- HTTP Request (Util): adds public information about the supplier where you use it.
- Notion (Integration): receives findings, proportion, compensating controls, and both arguments.
- When an ActionFlow is enough: If you are scoring answers against criteria, build the workflow. Weighing proportion is the agent.
Frequently asked questions
Start building AI workflows
Create a free account, open a template or a blank canvas, and run your first ActionFlow.
Newsletter
Get product updates
New nodes, agents, and product notes. We send mail only when we have something worth opening.