When a customer's AI agent questions a vendor's AI agent about security controls, the transcript of that exchange makes a poor record. It mixes commentary with commitments, invites a model to summarize words neither side agreed to, and places each side's confidential documents in the other side's model. A review run by agents needs a referee that admits checked, structured actions into a record both sides sign, and keeps everything else out of it.
Regulatory references verified as of October 31, 2026.
Why vendor reviews are moving to agents
On September 15, 2026, the OCC, the Federal Reserve Board, the FDIC and the NCUA published proposed third-party risk management guidance that would replace the 2023 interagency guidance. Comments close November 16, 2026 (OCC docket OCC-2026-0793). The proposal names "information security and cybersecurity capabilities and track record" as a diligence topic, scales the depth of diligence to the risk of the relationship, and says that certifications or results of assessments provided through consortia, standard-setting organizations and similar arrangements may be adequate for a bank's due diligence needs, depending on facts and circumstances.
In practice, each of those paths still ends in security questions a vendor answers. A vendor that sells to banks answers the same security questions for each customer, in each customer's format, on each customer's schedule. Both sides can now run agents that draft, read and score those answers. The next step: let the customer's agent question the vendor's agent directly and work through the list.
That step makes the review faster and leaves the record weaker. Our guide to third-party risk management for AI model providers covers how to treat a rented model as a vendor relationship. This guide covers the proceeding itself: what has to be true when two companies' agents conduct the review.
Three ways the transcript fails
Commentary and commitment look the same
A vendor's agent writes: "We encrypt customer data at rest and rotate keys on a schedule. We are also evaluating customer-managed keys." The first sentence is a commitment the customer will rely on. The second is commentary. A transcript records both in the same voice, and months later, during an incident, nobody can say which sentences the vendor stood behind.
A summary puts words in a party's mouth
Long transcripts get summarized by a model. The summary becomes what the risk team reads, what goes into the vendor file and what an examiner sees. Neither party wrote or signed it. A model compressing forty turns can merge a plan into a practice or drop a qualification, and the file then attributes to the vendor a statement the vendor never made.
Confidential documents cross into the other side's model
To support an answer, the vendor's agent cites its audit report or its incident response policy. In a shared conversation, the cited text lands in the customer agent's context, where it can be retained, repeated or acted on. The customer has the same exposure with its scoring rubric.
What a refereed proceeding needs
Twelve requirements follow. Each is checkable in a running system, and each applies to security reviews, arbitrations and other proceedings between two parties' agents.
1. A referee distinct from both agents
A service distinct from both agents, which one party may operate, receives every turn, decides what enters the record and builds each side's view of the other side's turns. A manager agent that takes part for one party cannot serve as referee, because its context belongs to that party.
2. Commentary never becomes the record
Each turn carries free commentary and zero or more structured actions: pin a document, answer an item, challenge, cure, lodge an exhibit, sign. The referee admits an action when the session type permits that kind of action and the action passes the referee's check. Admitted actions form an ordered operative record, and the referee computes a hash over that ordered list. A rejected action leaves the record and its hash unchanged. A claim that an item is complete, without the evidence the session type requires, is rejected. A model-written summary can neither enter the record nor close the session.
3. Confidential documents represented by identifier and hash
The answering party pins the documents it will cite. The record stores an identifier, a title and a hash for each document, and the body stays with the referee. The other side's agent sees the identifier, the title and the hash. If a model pastes a document it was asked to cite, the referee strips that content from the commentary before the other side sees the turn.
4. Answers that cite a span in a pinned document
An answer names the item, the answer, the document and a span of text from it. The referee accepts the answer when the span occurs in that pinned document. The customer's agent receives the answer and the span. The customer tests each answer against the vendor's evidence without taking custody of it.
5. Sealed scoring and hash-checked exhibits
The asking party can seal its scoring rubric as a commitment. The record stores the rubric's hash, and the other side learns that a rubric is sealed and nothing more. In a dispute, a party lodges an exhibit with an identifier, a title and a hash, and the referee accepts it when the hash matches the content. The other side sees the title and the hash.
6. One frozen questionnaire, hashed before the first turn
Bind the session to an instrument: a frozen list of questions or issues. Hash it and show both sides the hash before any turn. An amendment adds an item when one side proposes it and the other side commits to it; the amendment enters the record as its own entry, and the instrument hash stays the same. Three vendors on one instrument line up question by question.
7. Gap lists and comparisons computed without a model
The gap list is the set of items with no accepted answer, computed from the record. A comparison across vendors joins closed sessions on the instrument hash and the item identifier into a table of answers and gaps. Both are arithmetic over signed records. No model writes either one.
8. Close when both sides sign the current record hash
Each side signs the current record hash with its own key. The session closes when both signatures cover the same, current hash. When the referee accepts a new action after a signature, that signature goes stale and the side must sign again.
9. Signing keys pinned to the seat
Pin each side's signing key at the moment that side accepts the session. A signature from any other key does not count, and a signature made for the other seat is rejected.
10. Evidence encrypted to the recipient
Encrypt lodged evidence once, and wrap the content key for each authorized recipient under a visibility class: both agents, both humans, arbitrator alone, hash alone, or public receipt. The platform stores ciphertext and hashes, never plaintext or an unwrapped key. Changing the title, the recipient list, the ciphertext or the visibility class breaks verification of the evidence.
11. Consensus, dissent and an enforced procedure
Propositions move to consensus when both sides accept them. A dispute preserves both the proposition and the dissent, and neither side can alter the other side's dissent. A session can close with dissent unresolved: both sides sign the state of the record, and agreement with each proposition remains a separate question.
The session type defines the allowed steps, and model prompts do not. A questionnaire item moves from open to answered, then to challenged, then to cured or stood on, then to accepted or unresolved. The referee rejects an action that skips a step or comes from the wrong side. A challenge freezes the cited document version and span; a cure creates a new answer and preserves the original. Deadlines are explicit fields. A missed deadline is recorded as its own step with a procedural outcome, and silence never accepts an item.
12. A human arbitrator and a sealed receipt
Where the proceeding needs a decision, a person decides. The arbitrator sits outside both agents' contexts, takes no turns and opens sealed evidence with a single-use credential and the arbitrator's own pinned key. The arbitrator signs findings and an award over the receipt hash, and the decision is stored apart from both agents' histories. Neither agent writes the outcome.
On close, the platform signs a receipt carrying the instrument hash, the record hash, the operative record, the gap list and both signatures. The receipt carries no commentary, no document bodies and no exhibit content. An auditor, an examiner or the customer's own risk committee can verify it without trusting a model-written summary.
Transcript versus refereed record
| Question | Agent transcript | Refereed record |
|---|---|---|
| What counts as a commitment? | Any sentence, in the same voice as commentary | Structured actions the referee checked and accepted |
| Who writes the outcome? | A model summary neither party signed | The ordered record, signed by both sides |
| Where does the vendor's audit report go? | Into the customer agent's context | Stays with the referee; the other side sees identifier, title and hash |
| Can an answer be checked against evidence? | By reading the document | By a cited span the referee verified in the pinned document |
| Can vendors be compared? | By reading every transcript | Joined on the instrument hash, item by item, without a model |
| When is it final? | When the conversation stops | When both sides sign the current record hash |
| What if a side goes silent? | Ambiguous | A recorded procedural outcome; silence never accepts an item |
| Who decides a dispute? | Unclear; often whoever writes the summary | A human arbitrator outside both agents' contexts |
| What can an auditor verify? | Nothing beyond the text | A signed receipt, without the commentary |
Questions to ask any platform that hosts agent-to-agent reviews
- Who is the referee, and which party operates it?
- Can commentary or a model-written summary enter the record or close a session?
- When the vendor cites a document, does the document body reach the customer's model?
- Is the questionnaire frozen and hashed before the first turn?
- Does a new action make earlier signatures stale?
- What does the receipt contain, and can a third party verify it?
Where the proposed guidance fits
The proposed guidance does not mention artificial intelligence. It does describe due diligence as the process of assessing a third party's ability to perform the activity, and ongoing monitoring as the process of assessing and monitoring third-party performance. A record from an agent-run review feeds both. It tells the bank which statements the vendor committed to, against which documents, on which date, under which questions.
The proposal states that "non-compliance with this guidance will not result in supervisory action against a banking organization." Supervisory guidance produces findings, not fines, and examiners still review the diligence a bank relied on. A transcript and a model summary make that review harder. A signed record of checked answers makes it easier. Either way, the bank's accountable risk owner decides whether to accept the vendor, with the record as evidence.
How APERION approaches it
Owned intelligence, governed from the first call. APERION future-proofs the hybrid AI estate: every agent and every model an enterprise rents or owns, governed from one control point inside its own walls. The control point sits in the path between agents and every model and tool they call, rented or owned, and keeps each action inside the authority a person delegated.
APERION built the refereed pattern in this guide, with security review and arbitration session types. In an APERION session, commentary never enters the record, each answer cites a document the answering party pinned, and both sides sign the record before it closes. The accountable human decides, and the record shows who decided, when and under which policy.
The Trust Fabric sets out the four layers underneath: verified identity, access governance, runtime governance, and audit and evidence. The thesis is set out on AI governance.
A verified person, the authority that person delegated, the agent that used it, the policy that applied, the decision and the record of all of it. That chain is the product.
Frequently asked questions
Can AI agents complete a vendor security questionnaire?
Yes. Agents can draft answers and work through a list faster than people can. Speed is one question. The record is the harder one: which statements the vendor committed to, against which documents, signed by whom. A review between two companies' agents needs a referee that admits checked answers into a signed record and keeps commentary, summaries and confidential documents out of it.
Why not keep the full transcript as the record?
A transcript mixes commitments with commentary in the same voice, so nobody can later say which sentences the vendor stood behind. A long transcript often gets summarized by a model, and the summary attributes statements neither party made or signed. A transcript also carries any document a vendor's agent pasted into the customer agent's context. Keep the transcript for context if useful, and treat the signed operative record as the record.
How can a customer verify an answer without seeing the vendor's documents?
The vendor pins its documents with a referee, which stores a hash of each one. Every answer must cite a span of text, and the referee confirms the span occurs in the named pinned document before it accepts the answer. The customer's agent receives the answer, the span and the document's hash, and the document body stays with the referee. The customer gets a checked answer without taking custody of the evidence.
What happens if the vendor's agent stops answering before a deadline?
Deadlines belong in the session as explicit fields. When a deadline passes, the referee records the expiry as its own step with a procedural outcome, and the item stays unanswered on the gap list. Silence never accepts an item. The customer's risk owner then sees exactly which questions lack an accepted answer and decides what that means for the relationship.
Does the proposed third-party risk guidance address AI agents in due diligence?
No. The September 2026 interagency proposal does not mention artificial intelligence. It does name information security and cybersecurity capabilities as a due diligence topic, scale diligence to risk, and say certifications or assessments provided through consortia may be adequate, depending on facts and circumstances. Each path still produces answers a bank relies on. When agents produce or collect those answers, the bank needs a record that shows which answers were committed and checked.
Who makes the final decision in an agent-run review or dispute?
A person. In a security review, the customer's accountable risk owner decides whether to accept the vendor, using the signed record and the gap list. In a dispute, a human arbitrator outside both agents' contexts opens sealed evidence, rules on objections and signs the award over the receipt hash. Neither party's agent writes the outcome.
Sources
- OCC, Federal Reserve Board, FDIC and NCUA, Proposed Third-Party Risk Management Guidance, 91 FR 58536, Federal Register document 2026-18859 (September 15, 2026); OCC Docket ID OCC-2026-0793; comments due November 16, 2026. Opened October 31, 2026.
- Board of Governors of the Federal Reserve System, Proposed Third-Party Risk Management Guidance (OP-1881), comment deadline November 16, 2026. Opened October 31, 2026.
Related reading
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs