Companion to the AI Sovereignty Risk Assessment Framework · CASE assessment d5716ec8-1c99-4dec-b609-ad5abb24cd02
# Is There a Hidden AI Supply Chain in Your Vendor?
*A plain-language walkthrough for GRC and compliance auditors, no technical background required*

**Organization:** Northwind Consumer Goods  
**Vendor / dependency assessed:** Nimbus Agents (enterprise AI agent platform)  
**Industry:** Fortune 500 enterprise

*Generated by the CASE assessment pipeline on 2026-10-28. Metric values were assigned by retrieval-grounded agents and scored deterministically; they have not been reviewed by a human expert.*

## Before You Start

This is not a technical document. It answers one practical question a compliance auditor is increasingly asked: “We use a lot of software. Some of it quietly grew an AI feature. What do we actually need to worry about, and how bad is it?” It walks through one vendor from start to finish using the same seven questions every time. A small italicised note under each section (“Technical cross-reference”) points back to the technical rubric for anyone who wants to trace a rating to the formal scoring model; you can ignore those notes and still get full value.

### The Rating Scale, In Plain English

| Rating | Meaning |
|---|---|
| **RATING: LOW** | Normal and contained. If something went wrong here, you'd find out quickly and fix it without much trouble. |
| **RATING: MEDIUM** | Could cause a real problem, and you might not find out right away, worth tracking, not yet an emergency. |
| **RATING: HIGH** | Could cause serious damage, a data leak, a regulatory violation, or losing the ability to operate, and by the time you noticed, it might already be too late to undo. |

## The Scenario

> Northwind Consumer Goods, a global consumer-goods company, runs an agentic procurement assistant on Nimbus Agents, an enterprise AI platform from a major vendor. Buyers ask it to compare supplier quotes, check contract compliance and raise purchase requisitions. To do this the agent calls Northwind's ERP and contract-management systems through connectors Nimbus provides.
>
> Each tool call carries live system state: supplier pricing, negotiated rebates, open purchase orders and approval-chain identities. Results are returned to the agent and, per the platform's documentation, retained in Nimbus's interaction logs for thirty days for abuse detection and debugging, accessible to Nimbus support staff on request. Northwind's data-classification policy covers documents and databases; it has no category for data that exists only as parameters and results of an agent's tool calls. Nimbus is Northwind's standard agent runtime and the same connectors are used by finance and supply-chain agents. Nimbus publishes changes to logging and retention in release notes at the time they take effect.

## Walking Through It, Category by Category

### 1. Whose AI brain is this, really?

Every AI feature is powered by some underlying model, hosted somewhere, controlled by someone. That someone is very often not the software vendor you actually have a contract with.

**Ask the vendor:**

- *Whose AI model is actually answering our questions, yours, or one you're renting from someone else?*
- *If we stopped paying you tomorrow, could we take this AI capability somewhere else, or does it just disappear?*
- *Can the AI's behavior change overnight without you telling us?*

**What we found:**

Northwind Consumer Goods does not host, hold or test the AI model behind its procurement assistant: the whole runtime sits inside Nimbus's cloud and is reached over Nimbus's interface. Nimbus can change how that platform behaves — including what it records and how long it keeps it — under its standard terms, and it tells customers by publishing release notes at the moment the change takes effect. Northwind therefore has no window in which to review, test or object to a behaviour change before its buyers and its ERP start relying on the changed behaviour, and it performs no validation of the runtime itself. Because the same platform is the standard runtime for finance and supply-chain agents too, any such change lands across all of those workloads at the same time.

> **RATING: HIGH**, In practice this means Northwind cannot demonstrate to an auditor that it knows when the system it relies on last changed, or that anyone checked the new behaviour before business decisions were made on it.

*Technical cross-reference: dimensions 1.3 (Model update / versioning control), 1.2 (Model weight custody / control), Org Action Required (UI), Trigger Conditions (AT), Primary Dependency Impact -- Integrity (VI), Silent/Automatic Trigger (AU) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:L/E:P/CR:H/IR:H/AR:M/S:P/AU:Y/R:U/V:C/RE:M/U:Amber`, score 7.1 (High).*

### 2. What are we feeding it?

Once an AI feature exists, the next question is simple: what of ours does it actually see? Employee inputs, uploaded reference material, and anything the AI can reach and act on all count.

**Ask the vendor:**

- *What do our employees actually type into this thing, and does it include customer or confidential information?*
- *Did we upload or connect any of our own internal documents for it to search?*
- *Can this AI take real actions, look things up, change things, or does it only talk?*

**What we found:**

This is the headline finding. Every time a buyer asks the assistant to compare quotes, check a contract or raise a requisition, the assistant pulls live information out of Northwind's ERP and contract-management systems — supplier pricing, negotiated rebates, open purchase orders and the names of people in the approval chain — and that information travels through Nimbus as part of the request and the reply. Nimbus's own documentation says these requests and replies are kept in its interaction logs for thirty days and can be read by Nimbus support staff on request, which requires nothing more than the standard contract. Northwind's data-classification policy covers documents and databases and has no category at all for information that exists only as part of an agent's tool calls, so none of Northwind's usual handling, masking or retention rules apply to it. The same assistant also writes back into production systems, so if these requests or replies were altered, the ERP would act on them as legitimate, correctly-authorised transactions. Comparable exposures through enterprise agent connectors have already occurred in the real world, not only in research.

> **RATING: HIGH**, For thirty days at a time, Northwind's complete procurement negotiating position and the identities of its approvers sit readable in a supplier's system, outside every control Northwind has written down.

*Technical cross-reference: dimensions 2.4 (Tool-call parameters and results (agentic-specific)), 2.1 (Prompts / user inputs), Access Path (AV), Primary Dependency Impact -- Confidentiality (VC), Blast-Radius Concentration (V) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:L/E:A/CR:H/IR:H/AR:M/S:P/AU:Y/R:U/V:C/RE:M/U:Amber`, score 7.3 (High).*

### 3. What does it create from our data: and where does THAT go?

This is the part almost every vendor review misses entirely. AI systems don't just read your data, they transform it into new things: mathematical fingerprints of your documents, logs of every answer given, records of which answers got a thumbs-down. Those new things get stored somewhere, often by a company you've never heard of and never contracted with directly.

**Ask the vendor:**

- *Does this turn our documents into some kind of derived file (an “embedding”) so it can search them faster?*
- *If so, who stores that derived file, you, or a completely different company?*
- *Do you keep a copy of everything the AI said back to us, a log of how we used it, or a record of when we said the answer was wrong?*

**What we found:**

The information the assistant handles does not simply pass through and disappear: the thirty-day interaction logs are a rolling copy of live pricing, rebate, purchase-order and approver data drawn from across procurement, finance and supply chain, held in Nimbus's own environment. This copy does not appear in any data flow Northwind has reviewed and is not covered by its classification policy, so no retention limit, minimisation or deletion control of Northwind's own applies to it. Northwind has no way to purge these records, export them or verify their deletion; it can only wait for the vendor's retention period or ask the vendor. The retention period and the scope of what is captured are set by Nimbus and can be widened for all customers at once by a release note.

> **RATING: MEDIUM**, Northwind has a shadow copy of its commercial crown jewels that it cannot see into, cannot delete and did not plan for — moderate today only because the vendor currently caps it at thirty days.

*Technical cross-reference: dimensions 3.6 (Cached / derived artifacts), 3.5 (Telemetry / usage logs), 3.3 (Model outputs / completions), Trigger Conditions (AT), Primary Dependency Impact -- Confidentiality (VC), Portability / Exit Recovery (R) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:P/CR:H/IR:H/AR:M/S:P/AU:Y/R:I/V:C/RE:H/U:Amber`, score 5.7 (Medium).*

### 4. Who's deciding what the AI sees and does?

Between “the model” and “what we see” sits a set of decisions: which document gets pulled up, whether a filter blocks an answer, where an action actually executes. Each of those decisions can be made by yet another company.

**Ask the vendor:**

- *Who decides which of our documents actually get shown to the AI when it answers a question?*
- *Who runs the safety filter that sees every question and answer, and can we see its rules?*
- *If the AI takes an action on our behalf, where does that action actually happen, in your systems, ours, or a third location?*

**What we found:**

The connectors that reach into Northwind's ERP and contract-management systems are supplied and operated by Nimbus and run inside Nimbus's environment, holding standing access into Northwind's production systems. The assistant does not only read and advise — it raises purchase requisitions and issues contract-compliance judgements, so a wrong or manipulated instruction becomes a real transaction in a system of record. Supplier quotes and contract text that the assistant reads are outside Northwind's control and are a recognised route for hostile instructions to reach an agent and trigger action; published incidents show vendor-supplied agent connectors being altered so that the agent quietly did something other than what the workflow appeared to show. The same connectors are shared by the finance and supply-chain agents, so a problem in that layer reaches several production systems at once, and Northwind has no independent record of tool activity to reconcile against.

> **RATING: HIGH**, If anything goes wrong in the vendor's connector layer, it lands as authorised purchase activity in Northwind's live ERP across several business areas before anyone at Northwind would notice.

*Technical cross-reference: dimensions 4.3 (Tool/plugin execution environment), 4.2 (Orchestration / agent framework), Access Path (AV), Blast-Radius Concentration (V) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L/E:A/CR:H/IR:H/AR:M/S:N/AU:Y/R:U/V:C/RE:M/U:Amber`, score 7.3 (High).*

### 5. Which humans are actually looking at our stuff?

Not every risk is a computer. Somewhere in most AI products, an actual person, often a contractor, often outsourced, reads flagged conversations or debugs a problem using our data. That's a direct human set of eyes, independent of every technical safeguard above.

**Ask the vendor:**

- *Does a real person at your company, or a contractor of yours, ever read our conversations or our data?*
- *If a conversation gets flagged, does it go somewhere else to be reviewed or labeled?*
- *When your support engineers debug a problem for us, what can they see?*

**What we found:**

Nimbus's documentation states plainly that its support staff can access Northwind's interaction logs on request, for abuse detection and debugging. Those logs contain thirty days of live supplier pricing, rebates, open purchase orders and approval-chain identities drawn from procurement, finance and supply chain. There is no customer approval step, no notification to Northwind when such access happens, and no record Northwind can inspect afterwards; the request is made and granted entirely inside the vendor. This is the most routinely used access route at enterprise cloud and AI vendors — it is how support works — and it is covered by a generic support clause rather than having ever been assessed by Northwind as an access path to sensitive commercial data.

> **RATING: MEDIUM**, Named vendor employees Northwind has never vetted can read its live negotiating position whenever a support ticket gives them a reason, and Northwind would never know it happened.

*Technical cross-reference: dimensions 5.3 (Support / debugging access), 5.1 (Human review processes), Compulsion Complexity (AC), Primary Dependency Impact -- Confidentiality (VC) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:A/CR:H/IR:H/AR:M/S:N/AU:N/R:U/V:C/RE:M/U:Amber`, score 5.3 (Medium).*

### 6. Who's holding the steering wheel?

Somewhere, someone configures this thing: turns features on and off, sets filters, manages who has access, holds the keys. That control panel is itself a dependency, and it doesn't always sit where you'd expect.

**Ask the vendor:**

- *Where does the screen we'd use to configure or turn off this AI feature actually live?*
- *Is our employee login system, or our credentials to other systems, now tied into a system this vendor controls?*
- *Can settings change on us without anyone telling us?*

**What we found:**

Nimbus is Northwind's standard agent runtime, and the settings that matter — what is logged, how long it is kept, who may read it, what the connectors are allowed to do and what guardrails apply — are held and changed on the vendor's side. Northwind learns of those changes through release notes issued at the moment they take effect, so it has no opportunity to assess or reject them. Because the procurement, finance and supply-chain agents all sit on the same runtime and the same connectors, a single change or a single compromise at that level reaches every AI workload Northwind runs rather than one. Attacks against the administrative layer of comparable enterprise AI platforms, including checking whether prompt logging was switched on and abusing guardrail settings, have already happened to real customers.

> **RATING: HIGH**, One set of controls Northwind does not hold governs every AI workload it runs, and a change or compromise there is a company-wide event rather than a procurement one.

*Technical cross-reference: dimensions 6.1 (Centralized control plane / admin console), 6.4 (Configuration and policy management), Access Path (AV), Blast-Radius Concentration (V) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:A/CR:H/IR:H/AR:M/S:N/AU:Y/R:U/V:C/RE:H/U:Amber`, score 8.3 (High).*

### 7. How many companies are really in this chain: and did we agree to it?

Add it all up. This is the question that actually matters most, and it's the one almost no vendor security review asks directly: how many companies now sit between us and our own data, and which of those did we ever actually agree to?

**Ask the vendor:**

- *List every company standing between us and the raw computer running this AI. How long is that list, really?*
- *Did we ever affirmatively choose to adopt AI here, or did it just arrive?*

**What we found:**

Nimbus is described as an enterprise platform from a major vendor, which means there is almost certainly a chain beneath it — a model provider, cloud infrastructure and whatever stores the thirty-day interaction logs — but that chain is not disclosed to Northwind. The content flowing into it is not summaries; it is full supplier pricing, rebates, open purchase orders and approver identities, including personal data about Northwind staff. Northwind therefore cannot name the parties handling that data, cannot show that appropriate terms flow down to them, and cannot evidence that the processing is covered by its own records. Nimbus can substitute or add parties beneath it as a platform-wide decision, and Northwind would learn of it the same way it learns of logging changes: in a release note, after the fact. The only access actually evidenced in the scenario is Nimbus's own, which keeps this finding moderate rather than severe.

> **RATING: MEDIUM**, Northwind cannot answer the basic question of which companies hold its procurement data, which is an exposure in its own right if a regulator or a supplier asks.

*Technical cross-reference: dimensions 7.1 (Downstream subprocessors), 7.3 (Infrastructure providers beneath the AI vendor), Compulsion Complexity (AC), Trigger Conditions (AT), Downstream Blast-Radius Impact -- Confidentiality (SC) in the technical rubric. CASE vector `SOV:1.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:L/SA:L/E:P/CR:H/IR:H/AR:M/S:P/AU:Y/R:U/V:C/RE:M/U:Amber`, score 5.8 (Medium).*

## The Rollup

Put side by side, here is what one pass through all seven categories produced for Nimbus Agents (enterprise AI agent platform):

| Category | Rating | Carried by |
|---|---|---|
| 1. Whose AI brain is this, really? | **HIGH** | 1.3 Model update / versioning control |
| 2. What are we feeding it? | **HIGH** ◆ | 2.4 Tool-call parameters and results (agentic-specific) |
| 3. What does it create from our data: and where does THAT go? | **MEDIUM** | 3.6 Cached / derived artifacts |
| 4. Who's deciding what the AI sees and does? | **HIGH** | 4.3 Tool/plugin execution environment |
| 5. Which humans are actually looking at our stuff? | **MEDIUM** | 5.3 Support / debugging access |
| 6. Who's holding the steering wheel? | **HIGH** | 6.1 Centralized control plane / admin console |
| 7. How many companies are really in this chain: and did we agree to it? | **MEDIUM** | 7.1 Downstream subprocessors |

◆ Headline finding: category 2, dimension 2.4 (Tool-call parameters and results (agentic-specific)), CASE score 7.3 High [manual exit (R:U); concentrated (V:C); regulatory consequence (S:P); silent/automatic trigger (AU:Y); concurrent vendor notice (U:Amber)].

## What Northwind Consumer Goods Should Actually Do Next

- Northwind should immediately add a data-classification category for data that exists only as the parameters and results of an agent's tool calls, and classify supplier pricing, rebates, open purchase orders and approval-chain identities at the same level they carry inside the ERP.
- Northwind should require human confirmation before the assistant performs any consequential action — raising or amending a purchase requisition, or issuing a contract-compliance verdict — and should block automatic tool use once untrusted content such as a supplier quote or contract document has entered the conversation.
- Northwind should cut what the connectors can reach to the minimum each agent needs, giving the procurement, finance and supply-chain agents separate identities, credentials and permissions rather than sharing one connector set across all three.
- Northwind should obtain written commitments from Nimbus on advance notice of behaviour, logging and retention changes, on named support-access approval and notification, and on the retention and deletion of tool-call logs, and should treat the absence of those commitments as a contractual gap to escalate.
- Northwind should keep its own log of every tool call its agents make — what was requested, what was returned, which agent and which human was involved — so it has an independent record to reconcile against the ERP and can detect altered or falsified requisitions.
- Northwind should require Nimbus to disclose the parties beneath it that process or store interaction logs, together with their locations, and update its processing records and privacy assessments to cover the approval-chain identities held in those logs.
- Northwind should ask Nimbus to confirm whether minimisation, masking or a shortened retention period can be applied to tool-call logs, and whether support access can be gated on customer approval with an access record Northwind can inspect.
- Northwind should bring the Nimbus runtime into its model-risk and change-management regime, assigning a named owner to review every release note on publication and to test agent behaviour before buyers rely on it again.

## Running This Yourself

The seven questions above don't change from vendor to vendor, only the answers do. Any time your organization is told (or, more often, not told) that a piece of already-approved software just grew an AI feature, work through the same seven categories, in the same order, and rate what you find on the same three-colour scale. The scenario in this document exists to show you what that looks like done once, start to finish, the method itself travels.