10 questions to ask any agent-platform vendor.
Every platform demo shows the happy path. These are the questions that surface the architecture underneath — and because the Spine publishes its specifications in the open, each one links to a vendor-neutral spec you can check the answers against. Works on us, too.
Can the control plane run on infrastructure we own?
What a good answer sounds likeDeployment manifests, a reference topology, secrets integration, an upgrade path, and disaster recovery for a self-hosted install — shown, not promised. “Cloud-agnostic” on a slide is not an answer.
Red flagSelf-hosting is “on the roadmap,” or only the inference endpoint moves while policy, registry, and audit stay in the vendor's cloud.
Check the answer against: Sovereign Runtime Spine (SRS) — the runtime layer of the catalog
Is tool connectivity built on an open protocol — and is it one adapter among several, or your only bus?
What a good answer sounds likeMCP (or an equivalent open standard) as the tool substrate, with the gateway adding discovery, validation, throttling, and audit above it — plus room for API management, event streams, and workflow engines where they fit better.
Red flagA proprietary connector format you can't take with you, or “everything must be an MCP server” including workloads that clearly shouldn't be.
Check the answer against: Progressive Discovery Spine (PDS), which sits above MCP by design
Can we swap models without rewriting connectors or policy?
What a good answer sounds likeModel-neutral tool schemas, prompts, memory formats, and evaluator logic — demonstrated by running the same workload on two different providers. Portability proven by conformance tests, not branding.
Red flagTool definitions or policy that embed one vendor's function-calling format, streaming API, or context conventions.
Check the answer against: ACS-R13 and the conformance sections (BCP 14 requirements) in every public spec
Where does entitlement filtering happen in tool retrieval?
What a good answer sounds likeBefore or during retrieval — the model never receives the name, description, or schema of a tool its principal isn't entitled to use. The search index itself is entitlement-aware and tenant-scoped.
Red flagResults are filtered after retrieval, or “the system prompt tells the agent which tools it may use.”
Check the answer against: PDS-R7 (normative in PDS v1.3)
How do human identity and agent identity compose on a single call?
What a good answer sounds likeFederated: your IdP (Entra, Okta) for the human, a distinct verifiable workload identity per agent (SPIFFE-style), both preserved through every call — with constrained delegation and short-lived, audience-scoped tokens.
Red flagAgents inherit the human's full access token, or all agents share one service account.
Check the answer against: AGS-R2 (Agent Governance Spine v1.4)
Is every action auditable — and is there provably no alternate path?
What a good answer sounds likeAn append-only, tamper-evident decision log written outside the agent's control, plus the conditions that make it complete: gateway-only connector access, no static backend credentials in agent environments, network egress restrictions, and end-to-end correlation from human request to backend transaction.
Red flag“Everything is logged” — while agents hold API keys that let them call backends directly.
Check the answer against: AGS-R1, AGS-R3, and the “invariants to prove” checklist
Can security approve a connector independently of any prompt?
What a good answer sounds likeA promotion lifecycle — quarantine, security scan, schema validation, sandbox test, read-only pilot, production approval, with revocation reachable from every state — where no prompt content can influence a connector's status.
Red flagWhatever tools the agent's prompt mentions are the tools it gets.
Check the answer against: PDS-R11 and the connector promotion lifecycle (PDS v1.3)
Can we turn the internet off?
What a good answer sounds likeDeclared egress classes per agent — from no-network to internal-only to broker-only — enforced by network policy rather than prompt instruction, with the most restrictive class as the default.
Red flagAgents browse when the model decides browsing would help.
Check the answer against: AGS-R16 and the E0–E5 egress taxonomy (AGS v1.4)
What exactly happens when one agent asks another to do something?
What a good answer sounds likeA recorded delegation: initiating human, parent, child, precise task, allowed tools, data scope, budget, expiration, and whether sub-delegation is permitted — with the child's authority a strict subset of the parent's, and the delegation itself passing policy.
Red flagAgent-to-agent calls are just function calls, and a child agent can do things its parent couldn't.
Check the answer against: AGS-R15 and the delegation-record schema (AGS v1.4)
What do we keep if you disappear?
What a good answer sounds likeOpen, forkable specifications; exportable policies, registry, and audit data; documented schemas; no proprietary protocol between layers; source escrow and a perpetual internal-use license for anything closed; the right to keep running the last licensed version.
Red flag“We've never had a customer ask that.”
Check the answer against: The catalog's licensing — five public specs under CC BY 4.0 + MIT
The specs behind the questions are public.
Five of the Spine's nine layers are open source under CC BY 4.0 + MIT, with numbered normative requirements (BCP 14) you can put straight into an RFP. Ask every vendor — including us — which requirements they satisfy, which your existing stack provides, and where enforcement can be bypassed.