Reference case

dev · us-east-1
Reference cases / S08SyntheticExpert reviewed

Agentic procurement assistant logs ERP tool calls at the vendor

Organization
Northwind Consumer Goods
Vendor / dependency
Nimbus Agents (enterprise AI agent platform)
Industry
Fortune 500 enterprise
Headline dimension
2.4 Tool-call parameters and results (agentic-specific)
Expert headline · class 2
6.6MEDIUM
What are we feeding it?38 agent calls against Amazon Bedrock, five to ten minutes. The expert reading is never sent to the pipeline.

Description

What the agents read

Northwind Consumer Goods, a global consumer-goods company, runs an agentic procurement assistant on Nimbus Agents, an enterprise AI platform from a major vendor. Buyers ask it to compare supplier quotes, check contract compliance and raise purchase requisitions. To do this the agent calls Northwind's ERP and contract-management systems through connectors Nimbus provides.

Each tool call carries live system state: supplier pricing, negotiated rebates, open purchase orders and approval-chain identities. Results are returned to the agent and, per the platform's documentation, retained in Nimbus's interaction logs for thirty days for abuse detection and debugging, accessible to Nimbus support staff on request. Northwind's data-classification policy covers documents and databases; it has no category for data that exists only as parameters and results of an agent's tool calls. Nimbus is Northwind's standard agent runtime and the same connectors are used by finance and supply-chain agents. Nimbus publishes changes to logging and retention in release notes at the time they take effect.

Expert reading by hazard class

For comparison after a live run; never sent to the pipeline

ClassCarried byScoreRating
1 Whose AI brain is this, really?1.3 Model update / versioning control5.3MEDIUM
2 What are we feeding it?2.4 Tool-call parameters and results (agentic-specific)6.6MEDIUM
3 What does it create from our data: and where does THAT go?3.5 Telemetry / usage logs4.8MEDIUM
4 Who's deciding what the AI sees and does?4.2 Orchestration / agent framework6.1MEDIUM
5 Which humans are actually looking at our stuff?5.3 Support / debugging access5.3MEDIUM
6 Who's holding the steering wheel?6.2 Identity / access management integration6.4MEDIUM
7 How many companies are really in this chain: and did we agree to it?7.1 Downstream subprocessors4.7MEDIUM

Findings

Expert 'what we found' per class, with the vector each score is computed from

  1. 1 Whose AI brain is this, really?

    1.3 Model update / versioning control
    MEDIUM5.3

    Nimbus offers a catalogue of models from two providers and Northwind chose one. Nimbus retires and replaces catalogue models on its own schedule, but with 90 days' notice and overlap, so Northwind can re-test its procurement agents on the new model before the old one goes away. The choice of model is Northwind's; the menu is Nimbus's.

    Northwind picks the model from a menu the vendor rewrites, but gets time to check the new dish before the old one is taken away.

    SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:A/CR:H/IR:H/AR:M/R:U/V:C/U:Green · Medium

  2. 2 What are we feeding it?

    2.4 Tool-call parameters and results (agentic-specific)
    MEDIUM6.6

    Every tool call carries live commercial state out of the ERP: supplier pricing, negotiated rebates, open orders and who approved what. Nimbus keeps it for thirty days and its support staff can read it. Northwind's data-classification policy has no category for information that exists only as an agent's tool parameters, so no control was ever written for it. And the agent writes back: it raises requisitions.

    Northwind's most sensitive commercial data leaves the ERP through a channel its policies do not have a name for.

    SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:L/E:P/CR:H/IR:H/AR:M/AU:N/R:U/V:C/RE:M/U:Amber · Medium

  3. 3 What does it create from our data: and where does THAT go?

    3.5 Telemetry / usage logs
    MEDIUM4.8

    Beyond the thirty-day interaction logs, Nimbus keeps run telemetry indefinitely: which connectors were called how often, by which teams. Aggregated, it shows which suppliers Northwind is querying and how negotiation activity is trending, a signal Northwind would never share with a supplier.

    The pattern of Northwind's sourcing activity accumulates at the vendor with no retention limit.

    SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/CR:H/IR:H/AR:M/R:U/V:C · Medium

  4. 4 Who's deciding what the AI sees and does?

    4.2 Orchestration / agent framework
    MEDIUM6.1

    The agent loop, the connectors and the point where a tool call actually executes are all inside Nimbus. Northwind can see each step in Nimbus's trace viewer after the fact, but cannot intercept or approve a step before it runs, and Nimbus can change connector behaviour in a release.

    Northwind can watch the agent work but not stop a step before it reaches the ERP.

    SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P/CR:H/IR:H/AR:M/R:U/V:C · Medium

  5. 5 Which humans are actually looking at our stuff?

    5.3 Support / debugging access
    MEDIUM5.3

    Nimbus documentation states support staff may access interaction logs, including tool parameters and results, on request during an investigation. There is no human review or labelling of content, and the access is logged, but it is not reported to Northwind.

    A vendor engineer can read supplier pricing and rebates whenever a ticket is open.

    SOV:1.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/CR:H/IR:H/AR:M/R:U/V:C · Medium

  6. 6 Who's holding the steering wheel?

    6.2 Identity / access management integration
    MEDIUM6.4

    The connectors authenticate to the ERP and contract system with service credentials stored in Nimbus's secret store, shared by the procurement, finance and supply-chain agents. Tool permissions are configured in Nimbus's console behind Northwind's single sign-on, but Nimbus can change connector defaults for all tenants.

    The keys to the ERP are held by the vendor and shared by every agent Northwind runs.

    SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:L/E:P/CR:H/IR:H/AR:M/R:U/V:C · Medium

  7. 7 How many companies are really in this chain: and did we agree to it?

    7.1 Downstream subprocessors
    MEDIUM4.7

    The chain is Nimbus, the two model providers in its catalogue and their clouds, all disclosed in Nimbus's subprocessor list. Northwind adopted the platform knowingly and chose its model. The exposure in this scenario is what flows through the chain, not who is in it.

    A disclosed chain Northwind chose; the surprise is the data, not the companies.

    SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:P/CR:H/IR:H/AR:M/R:U/V:C · Medium

What the organization should do next

  1. Add 'agent tool-call data' to the data-classification policy and classify procurement connector traffic as commercially sensitive.
  2. Move connector credentials into Northwind's own secret store, scope them per agent and to read-only where the workflow allows, and rotate them.
  3. Negotiate a shorter retention period for interaction logs, a retention limit on run telemetry, and notification of any support access to Northwind's logs.
  4. Require an approval step, in Northwind's control, before the agent raises a requisition above a threshold.

Questionnaire answers

22 of 22 answered · these seed the metric priors

Show all 22 answers
OP-CRHow damaging would unauthorized disclosure of the data this AI dependency handles be for your organization?Severe: regulated, personal, privileged or trade-secret data
OP-IRHow damaging would an undetected change in this dependency's behaviour or outputs be?Severe: outputs drive automated actions, regulated decisions or safety-relevant processes
OP-ARHow long could your organization operate acceptably without this AI capability?Days: material business disruption
CL-CATEGORYWhich taxonomy category best describes the dependency you are assessing?Data input: prompts, RAG documents, fine-tuning data, tool-call parameters
D-AVWhere does this dependency run, and who can reach it?In the vendor's own cloud, reached directly over its API
D-ACWhat would the vendor, a subprocessor, or a legal authority have to overcome to access the data or change the service?Nothing beyond its standard terms of service or routine legal process
D-ATCan the vendor exercise this control at any time, or only when something specific happens?At its discretion, at any time (standing right under the contract)
D-PRWho is in a position to exercise this control?Only the primary vendor we contract with
D-UIDoes the exposure require any action by your organization?Ordinary use of the service is enough to trigger it
D-VCAt this dependency itself, how much confidentiality could be lost?Full: the exercising party can read the sensitive data outright
D-VIAt this dependency itself, how much could its behaviour or outputs be altered without your knowledge?Partial: limited or detectable alteration
D-VAAt this dependency itself, could the capability be withdrawn or degraded by the exercising party?None: we could keep operating this component
D-SCBeyond this dependency, how much confidentiality could be lost at other systems or parties?Full: sensitive data becomes readable by a party we never contracted with
D-SIBeyond this dependency, could downstream systems or decisions be altered?Full: downstream systems act on altered outputs without detection
D-SABeyond this dependency, what would stop working, and could anyone be harmed?Some downstream workloads degrade
D-EHas this kind of control actually been exercised against organizations like yours?Demonstrated in research or incident reports, not confirmed against our stack
D-RIf the vendor relationship ended tomorrow, could you reconstitute this capability elsewhere?Yes, with manual migration effort (re-embedding, re-integration, re-contracting)
D-VHow many of your AI workloads depend on this component?Many or all: shared control plane, gateway, identity or embedding store
D-SWould a loss of control here, on its own, trigger a reportable regulatory violation?Unknown
D-AUCould the loss event happen to all of the vendor's customers at once, with no case-by-case decision?No, it requires a discrete action against us specifically
D-REHow much effort would it take to exit this dependency or otherwise mitigate the exposure?Moderate: a project, but no re-architecture
D-UHow does the vendor notify you of sovereignty-relevant changes (model versions, subprocessors, hosting, terms)?Disclosed at the time the change takes effect

Notes: Expert reviewed. Primary vector derived from the questionnaire answers; category vectors and findings confirmed on review. The 'no non-AI analog' dimension: the finding is that a data category exists with no policy.