# Setup guide — Vendor Risk Assessment Agent

## 1. Install and connect TPRM sources

Install the agent and connect it to your vendor register and evidence store.

```
pipx install vendor-risk-agent
vendor-risk-agent connect --register onetrust --evidence-store sharepoint
vendor-risk-agent doctor
```

## 2. Configure risk criteria and gate

Define which vendors may be fast-tracked. Critical-data and high-risk always escalate.

```
cp .env.example .env
ANTHROPIC_API_KEY=sk-ant-...
FAST_TRACK_ONLY_IF: { data: "non_sensitive", evidence: "complete", risk: "low" }
ALWAYS_ESCALATE: ["sensitive_data", "critical_systems", "missing_soc2", "prior_breach"]
```

## 3. Define required evidence per tier

Tell it what evidence is mandatory so absences become explicit gaps.

```
# criteria.yml
required_for_data_access:
  - dpa
  - soc2_or_iso27001
  - breach_history_check
  - mfa_and_encryption_attested
weight_by_data_sensitivity: true
```

## 4. Assess a vendor from the CLI

Run an assessment and review the cited findings and tier before relying on it.

```
vendor-risk-agent assess --vendor 'Acme Analytics' --explain
# prints domains+evidence+gaps, overall_risk, recommendation, conditions
```

## 5. Integrate with onboarding

Route new vendors for a first-pass assessment; high-risk/critical-data ones auto-route to the risk team.

```
# onboarding webhook -> POST https://your-host/vendor/assess
# recommendation=escalate auto-assigns to the risk queue
```
