AI Agent Security Platform RFP Template

Most AI agent security RFPs ask vendors whether they "support guardrails" and get back a yes from every bidder, which tells the buyer nothing. This template is a ready-to-issue request for proposal for platforms that discover, identify, authorise, monitor and contain AI agents: agent security posture tools, agent identity and access products, MCP and tool gateways, and runtime guardrail layers. Every requirement has an ID, a priority, the evidence a vendor must supply and a test you can run in a proof of value, and each is mapped to the OWASP Top 10 for Agentic Applications (2026) and OWASP LLM06 Excessive Agency. It assumes you have already decided the category is needed: use the AI Agent Identity Security Buyer's Guide to scope the market and the AI Vendor Security Questionnaire Template for the supplier's own security. The requirements follow the incident lifecycle on purpose: a platform is only worth buying if it helps you detect, contain and prove what an agent did.

How to use this template

Customise: replace [Organisation], [Platform] and other placeholders, and delete requirements for agent types you do not run (for example browser agents or MCP servers).
Set priority honestly: mark each requirement M (must, pass or fail), S (should, scored) or C (could, tie-breaker). Keep M items to those whose absence would stop the purchase; ten to fifteen is typical.
Demand evidence, not assertions: every answer must point to product documentation, a screenshot, an API reference or a demonstration. An unevidenced "yes" scores as zero.
Test in a proof of value: the "Test" column describes what to run against your own agents. Shortlist two or three vendors and run the same tests on each.
Figures are illustrative: timings and thresholds in brackets, such as [60 seconds], are placeholders for your own targets, not market benchmarks.

1. Scope and triggers

[Organisation] issues this RFP to select a platform that secures AI agents across [business units] and [environments]. In scope:

Agents built in house on [frameworks], agents embedded in SaaS products, coding assistants and agents used by developers, and agents that call tools through MCP servers or APIs.
The non-human identities agents use: OAuth clients and tokens, API keys, cloud roles, service accounts and workload identities.
Out of scope: model training security and content safety for consumer chat, unless the vendor covers them as part of the same product.

Triggers for issuing or re-issuing: a first production agent with write access to business systems, an agent inventory larger than [50] agents, a regulatory or audit finding on agent oversight, or renewal of an existing contract. Responses are due within [20 working days]; questions close [5 working days] before the deadline.

2. Roles and contacts

Role	Responsibility in the selection	Contact
Executive sponsor	Approves budget, accepts the final recommendation	[Name]
Procurement lead	Issues the RFP, manages clarifications, keeps scoring fair	[Name]
AI platform owner	Defines agent estate and integration points; runs proof of value tests	[Name]
IAM or NHI lead	Scores sections 3 and 4	[Name]
SOC lead	Scores sections 6 and 7; validates detections against test scenarios	[Name]
Risk, audit or DPO	Scores section 8; checks evidence meets regulatory needs	[Name]
Vendor respondent	Named technical contact who signs the response	[Vendor contact]

3. Discovery and inventory requirements

You cannot secure agents you do not know about. NIST CSF 2.0 ID.AM-02 and SP 800-53 CM-8 expect an inventory of software and services; for agents that inventory must also show what each agent can reach.

ID	Pri	Requirement	Evidence and test	Maps to
AP-3.1	M	Discover agents across [cloud AI services, SaaS, code repositories, endpoints] without requiring each team to register them	List of supported connectors; test: find a deliberately unregistered agent in the pilot tenant	ASI10 Rogue Agents
AP-3.2	M	For each agent, record owner, purpose, model, tools, MCP servers, credentials and data sources	Sample inventory export (CSV or API)	ASI03, LLM06
AP-3.3	S	Flag agents with no human owner, an owner who has left, or no activity in [30] days	Screenshot of orphan report; test with a disabled owner account	ASI10
AP-3.4	S	Discover MCP servers in use, local (STDIO) and remote, and show which agents connect to them	Demonstration on a developer workstation	ASI04 Agentic Supply Chain Vulnerabilities
AP-3.5	C	Assign a risk tier per agent from permissions, data sensitivity and autonomy	Tiering logic documentation	LLM06 excessive autonomy

See the AI Register and AI Inventory Template.

4. Agent identity and credential requirements

OWASP ASI03 Identity and Privilege Abuse covers agents acting with borrowed or excessive credentials. NIST's NCCoE concept paper on software and AI agent identity and authorization (Initial Public Draft, February 2026) frames the same problem as identification, authorisation, auditing and non-repudiation of agents.

ID	Pri	Requirement	Evidence and test	Maps to
AP-4.1	M	Give each agent a distinct identity, never a shared human account or shared API key	Architecture document; test: two agents, separate audit trails	ASI03; 800-53 IA-9
AP-4.2	M	Find long-lived static secrets used by agents and report their age, scope and last use	Test: plant a [90]-day-old API key in an agent configuration	800-53 IA-5
AP-4.3	S	Support short-lived, audience-bound tokens for agent to tool calls (for MCP: RFC 8707 resource indicators and audience validation, as the MCP authorization specification requires)	Configuration guide; token sample showing audience and expiry	ASI03, ASI07
AP-4.4	S	Show when an agent acts on behalf of a user and preserve both identities in every record	Log sample with user and agent identifiers	800-53 AU-10
AP-4.5	S	Rotate or revoke agent credentials through the vault or identity provider already in use: [vault], [IdP]	List of supported integrations; test rotation in pilot	CSF PR.AA-01

See the AI Agent Credential Lifecycle and Rotation Guide.

5. Authorisation and tool control requirements

OWASP LLM06 traces excessive agency to three roots: excessive functionality, excessive permissions and excessive autonomy. These requirements test whether the platform can reduce each one.

ID	Pri	Requirement	Evidence and test	Maps to
AP-5.1	M	Enforce allow and deny policy per agent on tools, MCP servers and API operations, not just whole connectors	Policy language reference; test: block a delete operation while allowing read	ASI02 Tool Misuse and Exploitation; 800-53 AC-3
AP-5.2	M	Compare granted permissions with permissions used and recommend removals	Sample least-privilege report	LLM06; 800-53 AC-6
AP-5.3	S	Require human approval for defined high-impact actions (payments, deletions, external email, permission changes) with the approver recorded	Demonstration of an approval flow and its log entry	ASI09 Human-Agent Trust Exploitation
AP-5.4	S	Block an MCP server or proxy from passing a client's token through to downstream APIs	Test with a gateway configured for token exchange	MCP authorization spec; ASI07
AP-5.5	S	Restrict agent network egress to approved destinations	Configuration guide	800-53 SC-7, AC-4
AP-5.6	C	Version policies, support dry-run mode and roll back a policy in one action	Policy change history screenshot	CSF PR.AA-05

See the AI Agent Authorisation Guide and the AI Agent Action Approvals and Spending Limits Guide.

6. Detection and triage requirements

ID	Pri	Requirement	Evidence and test	Maps to
AP-6.1	M	Detect indirect prompt injection in retrieved content and tool results, not only in user prompts	Test: a document with embedded instructions that try to send data externally; report detection, block and false positives across [20] benign documents	ASI01 Agent Goal Hijack; LLM01
AP-6.2	M	Baseline each agent's normal tools, volumes and destinations and alert on deviation	Description of baseline method; test: agent calls a tool it never used before	ASI10; CSF DE.CM-09
AP-6.3	S	Detect attempts to make an agent run code or shell commands outside its sandbox	Test scenario results	ASI05 Unexpected Code Execution (RCE)
AP-6.4	S	Detect poisoning of agent memory or long-term context	Method description and test result	ASI06 Memory & Context Poisoning
AP-6.5	S	Alerts carry agent identity, user, tool call chain and the input that triggered it, and are sent to [SIEM] in under [60 seconds]	Sample alert payload; SIEM integration guide	800-53 SI-4

See the AI Agent Behaviour Baselining and Anomaly Detection Guide.

7. Containment and response requirements

ID	Pri	Requirement	Evidence and test	Maps to
AP-7.1	M	Suspend one agent, all agents using a given tool, or all agents of a business unit, from the console and the API	Test: time from decision to the agent's next call being refused (target [under 60 seconds])	CSF RS.MI-01; ASI08 Cascading Failures
AP-7.2	M	Revoke or trigger rotation of the agent's credentials as part of containment	Demonstration with [IdP] or [vault]	800-53 IR-4
AP-7.3	S	Show the blast radius: every system, record and identity the agent touched in a time window	Sample report	ASI08
AP-7.4	S	Integrate with [SOAR or ticketing] so playbooks can call containment actions	API reference	800-53 IR-4
AP-7.5	C	Restore an agent to a known-good configuration (prompt, tools, memory) after eradication	Demonstration	ASI06

See the AI Agent Kill Switch and Containment Guide and the AI Agent Incident Response Playbook.

8. Logging, evidence and notification requirements

ID	Pri	Requirement	Evidence and test	Maps to
AP-8.1	M	Record every tool call with timestamp, agent identity, delegating user, tool, parameters (redactable), result status and policy decision	Log schema; sample records	800-53 AU-2, AU-12; CSF PR.PS-04
AP-8.2	M	Protect logs from alteration, including by platform administrators, and support retention of [12 months] or more	Description of tamper-evidence controls	800-53 AU-9
AP-8.3	S	Reconstruct an incident timeline across agents and tools for an auditor	Test: rebuild a pilot scenario end to end	800-53 AU-10
AP-8.4	S	State where prompts, outputs and logs are stored, for how long, and whether they are used to train vendor models	Data processing terms; region list	CSF GV.SC-05
AP-8.5	S	Notify [Organisation] of a security incident in the platform itself within [24 hours]	Contract clause	800-53 SA-9

See the AI Agent Audit Trails for Regulators Guide for what the evidence must show.

9. Vendor assurance, deployment and exit

AP-9.1 (M) Platform security: current ISO/IEC 27001 certificate or SOC 2 Type II report covering the service; penetration test summary from the last 12 months.
AP-9.2 (M) Platform privilege: list every permission the platform needs in your cloud, SaaS and identity tenants, and justify each. A security platform with tenant-wide write access is itself a high-value non-human identity.
AP-9.3 (S) Deployment modes: state what works agentless, through API, through a gateway or proxy, and through an SDK, and the latency each adds.
AP-9.4 (S) Coverage roadmap: agent frameworks, model providers and MCP specification revisions supported now versus on the roadmap, with dates. Roadmap items score zero.
AP-9.5 (S) Exit: export of inventory, policies and logs in an open format on termination, and deletion certificate.

10. Scoring and proof of value

Section	Illustrative weight	Notes
3 Discovery and inventory	[15%]	Weighted higher if agent estate is unknown
4 Identity and credentials	[15%]
5 Authorisation and tool control	[20%]	Largest preventive value
6 Detection and triage	[15%]	Score from proof of value results, not claims
7 Containment and response	[10%]
8 Logging and evidence	[10%]	Weighted higher in regulated sectors
9 Assurance, deployment and exit	[10%]
Commercials	[5%]	Kept separate, scored after technical scores are fixed

Score S and C items 0 (absent or unevidenced), 1 (partial or roadmap with date), 2 (present with evidence) or 3 (present and passed the proof of value test). Any failed M item eliminates the bid.

Implementation guidance

Running the selection

Baseline your estate first: list your agents, frameworks, MCP servers and identity stack so vendors answer against reality. Run the AI Agent Threat Model Template on two representative agents to pick the test scenarios.
Issue and clarify: publish all clarification answers to all bidders.
Score paper responses: each scorer works alone, then the panel reconciles differences of more than one point.
Proof of value (two to four weeks): same pilot tenant, same agents and same test scripts for every shortlisted vendor. Start in monitor-only mode, then enable blocking on one low-risk agent. Record false positives and added latency.
Roll back plan: before enforcing any policy in the pilot, confirm the one-step disable path (AP-5.6) works, so a bad policy cannot halt business agents.
Decide and contract: carry M requirements, notification times and exit terms into the contract (CSF GV.SC-05, 800-53 SA-4).

Decision guidance

Gateway or posture first: if most agents are built in house and call tools you control, an inline gateway gives enforcement quickly. If most agents live inside SaaS products you cannot route, start with discovery and posture, then add enforcement where you can.
Small organisations: fewer than [20] agents can often be covered by identity provider features, a secrets vault and SIEM rules; use this template as a checklist against existing tools before buying.
Large organisations: prioritise API completeness and multi-tenant administration, since policies will be managed as code across many teams.

Framework mapping

Framework	Where this RFP contributes
OWASP Top 10 for Agentic Applications 2026	ASI01 to ASI10 mapped per requirement above
OWASP Top 10 for LLM Applications 2025	LLM01 Prompt Injection, LLM06 Excessive Agency
NIST AI RMF 1.0	Govern (ownership, supplier terms), Map (inventory), Measure (proof of value tests), Manage (containment)
NIST CSF 2.0	ID.AM-02, PR.AA-01, PR.AA-05, PR.PS-04, DE.CM-09, RS.MI-01, GV.SC-05, GV.SC-06
NIST SP 800-53 Rev. 5	CM-8, IA-5, IA-9, AC-3, AC-6, AU-2, AU-9, AU-10, SI-4, IR-4, SA-4, SA-9

Metrics after purchase

Percentage of known agents in the platform inventory with a named owner.
Agents using long-lived static secrets (trend to zero).
Granted versus used permissions ratio across agents.
Median time from containment decision to agent suspended.
Proof of value detection rate on your injection scenarios, re-run each quarter.

AI Agent Security Platform RFP: Requirements, evidence questions and scoring