# AI-agent procurement guide

Use this guide with the [editable procurement checklist](./ai-agent-procurement-checklist.csv). It is vendor-neutral. It does not certify a product, replace legal review or approve a deployment.

## 1. Define one workflow

Name the business owner, technical owner, inputs, actions, exclusions and acceptance criteria. Separate read, propose and execute permissions. A broad platform review can hide unsafe actions.

## 2. Ask for evidence, not assurances

For each required row, request an artifact or a repeatable test. Record the evidence link, reviewer and status in the CSV.

Evidence is stronger in this order:

1. A marketing statement.
2. Product documentation.
3. An observed demo.
4. A repeatable test in your environment.
5. Permission-cleared operating evidence from the scoped workflow.

A higher level does not make evidence correct. Check its date, scope and owner.

## 3. Run a bounded pilot

Test the permitted action, a denied action, duplicate delivery, timeout, partial failure, stop, revocation and recovery. Link each trace to the trigger, user, tenant, approval, tool call and observed outcome.

Use these supporting assets:

- [Governance assessment](https://www.ignitexsolutions.com/enterprise-ai-governance#governance-assessment)
- [Approval-policy template](./ai-agent-approval-policy-template.md)
- [Acceptance-test guide](./governed-ai-acceptance-tests.md)
- [Pilot evidence scorecard](./governed-ai-pilot-scorecard.csv)

## 4. Make a gate decision

Treat every required row as a gate for the scoped workflow. A gap blocks that scope until it is fixed, accepted by the accountable owner or removed from scope. Do not hide a critical gap inside an average score.

Immediate stop conditions include:

- The supplier cannot map an action to a user, tenant and approval.
- Approval is reusable outside its target, amount or time window.
- A denied action can still create a side effect.
- A retry can duplicate an uncertain action.
- Operators cannot revoke access or stop in-flight work.
- Audit evidence or data cannot be exported at exit.

## 5. Preserve the record

Keep the completed checklist, evidence, test results, exceptions, decision owner and review date together. Re-open the review after a material model, prompt, tool, permission, data-source or supplier change.

Version: 2026-10-09