What security questions should every AI agent vendor answer clearly?

The vendor demo is not the product. Ask to see the same workflow run on your data, not their sample data. That is where connector gaps and permission issues show up.

Measure rework, not just throughput. An agent that resolves 80% of cases but creates 30% more manual cleanup is not saving time.

We learned the hard way that 'human in the loop' is not a checkbox. If the approval UI is buried or slow, reviewers will batch-approve without reading.

Security questions should be part of the first demo, not a procurement afterthought. Ask about retention, sub processors, prompt-injection testing, and audit logs before you waste time on a trial.

We ran a 3-week pilot with a similar brief. The biggest gap was ownership after launch — if ops cannot edit prompts and tools without engineering, it dies. Pick the platform your weekly owner can actually maintain.

Agree on rollback and permissions before demos. We lost a week because the agent could write CRM fields with no audit trail. Make field-level history a go/no-go in the RFP.

Budget-wise, usage pricing looked cheaper until support volume spiked. Model a bad week, not an average day. That alone flipped our shortlist.

We compared two vendors on the same 20 tickets. Accuracy was fine; escalation quality was not. Score human handoff and confidence thresholds harder than model branding.