Assessment run

Northwind Consumer Goods does not host, hold or test the AI model behind its procurement assistant: the whole runtime sits inside Nimbus's cloud and is reached over Nimbus's interface. Nimbus can change how that platform behaves — including what it records and how long it keeps it — under its standard terms, and it tells customers by publishing release notes at the moment the change takes effect. Northwind therefore has no window in which to review, test or object to a behaviour change before its buyers and its ERP start relying on the changed behaviour, and it performs no validation of the runtime itself. Because the same platform is the standard runtime for finance and supply-chain agents too, any such change lands across all of those workloads at the same time.

Rating HIGH. In practice this means Northwind cannot demonstrate to an auditor that it knows when the system it relies on last changed, or that anyone checked the new behaviour before business decisions were made on it.

The information the assistant handles does not simply pass through and disappear: the thirty-day interaction logs are a rolling copy of live pricing, rebate, purchase-order and approver data drawn from across procurement, finance and supply chain, held in Nimbus's own environment. This copy does not appear in any data flow Northwind has reviewed and is not covered by its classification policy, so no retention limit, minimisation or deletion control of Northwind's own applies to it. Northwind has no way to purge these records, export them or verify their deletion; it can only wait for the vendor's retention period or ask the vendor. The retention period and the scope of what is captured are set by Nimbus and can be widened for all customers at once by a release note.

Rating MEDIUM. Northwind has a shadow copy of its commercial crown jewels that it cannot see into, cannot delete and did not plan for — moderate today only because the vendor currently caps it at thirty days.

The connectors that reach into Northwind's ERP and contract-management systems are supplied and operated by Nimbus and run inside Nimbus's environment, holding standing access into Northwind's production systems. The assistant does not only read and advise — it raises purchase requisitions and issues contract-compliance judgements, so a wrong or manipulated instruction becomes a real transaction in a system of record. Supplier quotes and contract text that the assistant reads are outside Northwind's control and are a recognised route for hostile instructions to reach an agent and trigger action; published incidents show vendor-supplied agent connectors being altered so that the agent quietly did something other than what the workflow appeared to show. The same connectors are shared by the finance and supply-chain agents, so a problem in that layer reaches several production systems at once, and Northwind has no independent record of tool activity to reconcile against.

Rating HIGH. If anything goes wrong in the vendor's connector layer, it lands as authorised purchase activity in Northwind's live ERP across several business areas before anyone at Northwind would notice.

Nimbus's documentation states plainly that its support staff can access Northwind's interaction logs on request, for abuse detection and debugging. Those logs contain thirty days of live supplier pricing, rebates, open purchase orders and approval-chain identities drawn from procurement, finance and supply chain. There is no customer approval step, no notification to Northwind when such access happens, and no record Northwind can inspect afterwards; the request is made and granted entirely inside the vendor. This is the most routinely used access route at enterprise cloud and AI vendors — it is how support works — and it is covered by a generic support clause rather than having ever been assessed by Northwind as an access path to sensitive commercial data.

Rating MEDIUM. Named vendor employees Northwind has never vetted can read its live negotiating position whenever a support ticket gives them a reason, and Northwind would never know it happened.

Nimbus is Northwind's standard agent runtime, and the settings that matter — what is logged, how long it is kept, who may read it, what the connectors are allowed to do and what guardrails apply — are held and changed on the vendor's side. Northwind learns of those changes through release notes issued at the moment they take effect, so it has no opportunity to assess or reject them. Because the procurement, finance and supply-chain agents all sit on the same runtime and the same connectors, a single change or a single compromise at that level reaches every AI workload Northwind runs rather than one. Attacks against the administrative layer of comparable enterprise AI platforms, including checking whether prompt logging was switched on and abusing guardrail settings, have already happened to real customers.

Rating HIGH. One set of controls Northwind does not hold governs every AI workload it runs, and a change or compromise there is a company-wide event rather than a procurement one.

Nimbus is described as an enterprise platform from a major vendor, which means there is almost certainly a chain beneath it — a model provider, cloud infrastructure and whatever stores the thirty-day interaction logs — but that chain is not disclosed to Northwind. The content flowing into it is not summaries; it is full supplier pricing, rebates, open purchase orders and approver identities, including personal data about Northwind staff. Northwind therefore cannot name the parties handling that data, cannot show that appropriate terms flow down to them, and cannot evidence that the processing is covered by its own records. Nimbus can substitute or add parties beneath it as a platform-wide decision, and Northwind would learn of it the same way it learns of logging changes: in a release note, after the fact. The only access actually evidenced in the scenario is Nimbus's own, which keeps this finding moderate rather than severe.

Rating MEDIUM. Northwind cannot answer the basic question of which companies hold its procurement data, which is an exposure in its own right if a regulator or a supplier asks.