Your customer’s vendor review will ask what your agents are allowed to do. Send proof they can check.
Coriqo keeps a record of what each of your agents may do, who approved it, and what happened when one went outside it. Each bank, fintech or insurer you sell to gets its own link to that record. Their risk team checks it on their own machine, without taking your word or ours.
Don’t trust us. Check.
The AI section of a vendor review usually comes down to four questions.
Your buyer’s third-party risk team has to answer to their own auditor or examiner. A written policy doesn’t settle it for them. They want evidence they can check, and the deal often waits until they have it.
Which tools it may call and which actions it may take, for this customer.
A named person, on a date, for a specific version of the agent’s instructions.
Who is told, how fast, and how you show the fix worked.
Without logging in to your systems, and without taking a screenshot on trust.
One record that answers all four, for every customer.
Each part below works in the product today.
A mandate for every agent
What an agent may do is written down as its mandate. Each change makes a new version, and a named person approves it. The person who asks for a change can’t be the one who approves it.
When the agent calls a tool its mandate doesn’t cover, a finding opens with the mandate version it broke, and the alert goes to whoever you route it to.
You can show: the mandate version an agent ran under, and who approved it.
A mandate check in your CI
coriqo-agents mandate check runs as a step in GitHub Actions or GitLab CI. The job fails if the agent has no mandate a named person approved. Pass it your mandate file and the job also fails when the file in your repository isn’t the approved one Coriqo holds.
Coriqo answers the check. Your pipeline fails the build. Coriqo never touches your deploys.
You can show: the CI step, and the approved mandate it compares against on every build.
Signed due-diligence answers
Answer a standard set of 13 questions once: customer data, security, AI governance, and incidents and continuity. List the documents you hold, such as a SOC 2 report, and your subprocessors. Sign the file with your own key, using a small standalone tool.
Your buyer checks the signature offline with the same tool. It needs Python, and no Coriqo account or connection. Change one answer and the signature no longer matches.
The signature proves the file hasn’t changed since you signed it. It doesn’t prove the answers are true, and Coriqo says so wherever it shows the pack.
A Trust Room for each customer
A link you send to one customer’s reviewer, who needs no Coriqo login. It shows the agents you picked and their current mandates, findings opened and closed with the time to acknowledge and the time to close, retest results, and your latest signed checkpoint.
The link expires, you can revoke it, and every view is logged. The reviewer downloads a signed verification file and checks it themselves.
You can show: each customer only the agents that serve them, with totals by default.
Send what your agents already emit. Coriqo stays out of the request path.
Coriqo reads what your agents did. It never sits between your agent and your customer.
OpenTelemetry
Send OTLP traces that follow the OpenTelemetry GenAI conventions. Model calls and tool calls land on the agent they belong to.
LangSmith and Langfuse
Their OpenTelemetry exports come in through the same endpoint, with their own attribute names mapped for you.
Python SDK
Wrap a decision function with @track_decision, or send runs and decisions from code. Install it from source for now. It isn’t on PyPI yet.
CI jobs
Ready-made jobs for GitHub Actions and GitLab CI run the mandate check on every build.
Signed webhooks
Alerts reach your own systems as webhooks signed with HMAC-SHA256 over a timestamp and the body, so your receiver can check each call came from Coriqo.
Service-account API keys
Your pipelines and agents send with a service-account key, not a person’s login. Revoke one key without touching the others.
Each checkpoint is logged in Sigstore’s public Rekor log and time-stamped by DigiCert. Your buyer can check both without asking you or us.
The verifier is open source. Anyone can run it, with no account: github.com/coriqo/coriqo-seal-verifier. For how the record is built, see How it’s built.
Two things a platform vendor will ask for that we don’t have yet.
We’d rather you hear it here than in the middle of your own customer’s review.
Publishing your own pack to the exchange
Today you sign your due-diligence pack and send the file to each buyer yourself. Listing it in the Coriqo vendor exchange, where any organization on Coriqo can find it, goes through a Coriqo operator. You can’t publish or update a listing on your own yet.
A Trust Room in your brand, and a partner API
A Trust Room carries Coriqo’s layout, not your logo or domain. There is also no partner API for setting up a separate Coriqo workspace for each of your customers. Today an admin on your side makes each room from the Trust Rooms screen.
If either one decides whether you can use Coriqo, tell us. It changes what we build next. Other limits of the product are on Known limitations.
The proof sprint: one agent, one customer, checked by their reviewer.
We agree the success criteria in writing before day one. The sprint ends when one customer’s reviewer has checked the record themselves.
One agent, its owner and its mandate, approved by a named person on your side.
Traces flowing from OpenTelemetry or the SDK, and the mandate check running in your CI.
In a test environment: the agent calls a tool it may not use, a finding opens, someone is alerted, the fix is retested, and the finding closes.
A Trust Room goes to one customer’s reviewer, who downloads the verification file and checks it offline.
Fixed fee, credited against year one. The fee is agreed before the sprint starts and depends on scope. If you go ahead, it counts in full toward your first year. See pricing.
Bring the vendor review you’re answering now.
Send us the AI and agent questions from it. On a 20-minute call we’ll go through which answers you could back with a record today and which you couldn’t. If Coriqo isn’t the right fit, we’ll tell you.