# Examples — Vendor Risk Assessment Agent

## Low-touch SaaS, complete evidence → fast-track recommend

A scheduling tool with no access to sensitive data, valid SOC 2, and a complete questionnaire. Clearly low risk.

**Input**

```
Vendor: MeetEasy (scheduling). Data access: calendar metadata only, no PII/customer data. Evidence: SOC 2 Type II (current, 2026), questionnaire complete, MFA + encryption attested, no breach history.
```

**Output**

```
{
  "vendor": "MeetEasy",
  "data_access": "Calendar metadata only — no PII or customer data (non-sensitive)",
  "overall_risk": "low",
  "recommendation": "fast_track",
  "domains": [
    { "domain": "security", "evidence": "SOC 2 Type II current (2026); MFA + encryption attested", "gap": "none", "rating": "low" },
    { "domain": "compliance", "evidence": "DPA in place; no regulated data", "gap": "none", "rating": "low" },
    { "domain": "data_access", "evidence": "Calendar metadata only; no subprocessors with data access", "gap": "none", "rating": "low" },
    { "domain": "breach_history", "evidence": "No known incidents", "gap": "none", "rating": "low" }
  ],
  "gaps": [],
  "conditions": [],
  "rationale": "Non-sensitive data access, current SOC 2, complete evidence, and no breach history. Low inherent and residual risk.",
  "escalation": { "needed": false, "to": "none", "reason": "" },
  "not_final_approval": true
}
```

**Note:** Clearly low-risk with complete, cited evidence and no sensitive-data access, so the agent recommends fast-tracking — but note 'not_final_approval' stays true: it surfaces a clean assessment, a human confirms. This is the volume that should move fast.

## PII-handling vendor with gaps → conditional, list remediations

A vendor that will process customer PII has a DPA gap and an expired SOC 2. Remediable, so the agent recommends conditions rather than a flat no.

**Input**

```
Vendor: DataCleanse (data enrichment). Data access: customer PII. Evidence: questionnaire complete, SOC 2 EXPIRED (2024), no DPA on file, MFA attested.
```

**Output**

```
{
  "vendor": "DataCleanse",
  "data_access": "Customer PII (sensitive)",
  "overall_risk": "moderate",
  "recommendation": "conditional",
  "domains": [
    { "domain": "security", "evidence": "MFA attested; SOC 2 present but EXPIRED (2024)", "gap": "No current SOC 2 / equivalent", "rating": "moderate" },
    { "domain": "compliance", "evidence": "No DPA on file for a PII-processing vendor", "gap": "Missing DPA", "rating": "high" },
    { "domain": "data_access", "evidence": "Processes customer PII", "gap": "Scope/retention not documented", "rating": "moderate" },
    { "domain": "breach_history", "evidence": "No known incidents", "gap": "none", "rating": "low" }
  ],
  "gaps": ["No DPA for a PII processor", "SOC 2 expired (2024)", "Data scope/retention undocumented"],
  "conditions": ["Execute a DPA with data-processing scope, retention, and breach-notification terms", "Provide a current SOC 2 Type II (or ISO 27001)", "Document data scope and retention"],
  "rationale": "Processes customer PII but is missing a DPA and a current SOC 2. Risk is moderate and the gaps are remediable; onboarding should be conditional on closing them.",
  "escalation": { "needed": false, "to": "none", "reason": "" },
  "not_final_approval": true
}
```

**Note:** Because the vendor touches PII, the missing DPA is rated high — but the gaps are remediable, so the agent recommends a conditional path with a concrete remediation checklist rather than guessing or clearing it. It never assumes the expired SOC 2 still counts.

## Critical-data vendor with prior breach + missing evidence → escalate

A vendor that would access critical systems has an unremediated breach and an incomplete questionnaire. The agent refuses to score it clean and escalates.

**Input**

```
Vendor: CoreConnect (infrastructure integration). Data access: production systems + customer data (critical). Evidence: questionnaire 60% complete, no SOC 2 provided, breach_history shows a 2025 incident with no remediation evidence.
```

**Output**

```
{
  "vendor": "CoreConnect",
  "data_access": "Production systems + customer data (critical)",
  "overall_risk": "high",
  "recommendation": "escalate",
  "domains": [
    { "domain": "security", "evidence": "No SOC 2 provided; questionnaire only 60% complete", "gap": "No security certification; key questions unanswered", "rating": "high" },
    { "domain": "compliance", "evidence": "Incomplete", "gap": "Insufficient evidence to assess", "rating": "high" },
    { "domain": "data_access", "evidence": "Production + customer data", "gap": "Critical access with unverified controls", "rating": "high" },
    { "domain": "breach_history", "evidence": "2025 incident on record", "gap": "No remediation evidence provided", "rating": "high" }
  ],
  "gaps": ["No SOC 2 / security certification", "Questionnaire 40% unanswered", "Unremediated 2025 breach"],
  "conditions": [],
  "rationale": "Critical access to production and customer data, no security certification, an incomplete questionnaire, and a prior breach without remediation evidence. This cannot be assessed as low/moderate and must not be auto-cleared.",
  "escalation": { "needed": true, "to": "risk_team", "reason": "Critical-data access with a prior unremediated breach and missing key security evidence." },
  "not_final_approval": true
}
```

**Note:** The defining case: critical data access + a prior unremediated breach + missing evidence. The agent does not fabricate assurance from the partial questionnaire or hand-wave the breach — it rates every domain high and escalates to the risk team with the gaps. Missing evidence is treated as risk, not as a pass.
