How to choose an AI agent provider: 10 questions to ask before you sign

To choose an AI agent provider, ask how they will limit what the agent can touch, which actions will need your approval, how they handle prompt injection, what gets logged, who looks after the agent after launch, and how you can leave. A provider that answers those questions clearly and in writing is usually a safer choice than the one with the most impressive demo.

These themes are not ours alone. In May 2026, Canada’s Cyber Centre joined cyber security agencies from the United States, the United Kingdom, Australia and New Zealand in releasing joint guidance called Careful adoption of agentic AI services, according to the Canadian Centre for Cyber Security and CISA. The ten questions below turn that kind of advice into plain questions you can ask on a sales call, whether you run a dental clinic, a property management firm, an HVAC company, an online store or a nonprofit.

For each question you will find why it matters, what a good answer sounds like, and a red flag to watch for.

1. Which workflow will you start with, and how will we know it is working?

Why it matters. The joint guidance advises starting small. CISA’s summary recommends beginning with use cases that are low risk and non-sensitive, and the UK NCSC’s summary recommends tightly bounded pilots with clearly defined tasks before you expand.

A good answer. One named workflow, such as booking confirmations for a clinic or invoice follow-ups for an accounting firm, with a measure you both agree on, like hours saved per week or response time.

Red flag. “We will automate your whole back office” in the first phase.

2. What exactly will the agent be able to access?

Why it matters. CISA and the UK NCSC both warn against giving an agent broad or unrestricted access to sensitive data or critical systems. The OWASP guidance on prompt injection also lists least privilege access as a core mitigation.

A good answer. A written list of every system, folder, mailbox and permission level, with the reason each one is needed. A property manager’s agent that drafts maintenance replies does not need access to the accounting system.

Red flag. “It just needs admin access to make setup easier.”

3. Which actions will need my approval before they happen?

Why it matters. OWASP recommends requiring human approval for high-risk actions, and the UK NCSC stresses keeping meaningful human oversight and control. We looked at one vendor’s version of this in our post on Claude Duet’s approval rules.

A good answer. A short, specific list: sending anything to a customer, paying, signing, deleting, or changing records. Plus a list of actions the agent cannot take at all.

Red flag. Approvals described as optional, or so frequent that your team will click through them without reading.

4. How do you handle prompt injection?

Why it matters. Prompt injection is when instructions hidden in an email, web page or file trick an AI agent into doing something you did not ask for. It is first on OWASP’s list of risks for AI applications, as shown on the OWASP LLM01 page and noted by the UK NCSC. Neither source claims it can be fully solved. OWASP says it is unclear whether there are fool-proof methods of prevention, and the NCSC says prompt injection may never be totally mitigated in the way SQL injection can be. Our post on prompt injection through email shows how this plays out.

A good answer. Layered controls: limited access, approvals on risky actions, and testing with deliberately malicious inputs before go-live. The NCSC puts one rule simply: an AI model processing emails from outside people should not have access to privileged tools.

Red flag. “Our agent cannot be prompt injected.” The NCSC specifically advises caution with any product that claims it can stop prompt injection.

5. Whose account does the agent use, and how fast can access be removed?

Why it matters. An agent working under a staff member’s login is hard to track and hard to switch off. The UK NCSC’s summary recommends giving agents the minimum access for the shortest time needed and avoiding long-lived credentials. We cover the setup in our guide to AI agent accounts and permissions.

A good answer. The agent has its own account, its credentials are stored separately from the AI model, and access can be removed in minutes.

Red flag. “Just share your password with us and we will plug it in.”

6. What gets logged, and can I see it?

Why it matters. CISA lists obscure event records among the added risks of agentic AI, and the UK NCSC recommends monitoring agent behaviour for unusual or unexpected activity.

A good answer. A log of what the agent read, decided and did, kept for a stated period, that you can review without filing a request.

Red flag. “The AI handles it, there is nothing to look at.”

7. Who owns the agent after launch, and who can switch it off?

Why it matters. The UK NCSC’s summary says organizations should be clear about who owns an agentic system, who approves its access, who monitors it, who reviews incidents and who can stop it.

A good answer. Named people on both sides, with a documented way to pause the agent.

Red flag. Nobody can tell you how to turn it off.

8. What happens when the agent gets something wrong?

Why it matters. Mistakes will happen. The UK NCSC’s summary recommends incident response plans that cover agent failures, misuse and loss of control.

A good answer. A clear process: how you report an issue, how quickly they respond, how the error is fixed, and how they stop it from happening again. For a retailer, that might be an agent that sent the wrong order update. For an HVAC company, a booking placed in the wrong slot.

Red flag. A contract that puts every agent error on you, with no support process behind it.

9. What is included in the ongoing fee, and what is billed separately?

Why it matters. AI agents need care after launch. Connected apps change, policies change, and the agent needs tuning. You want to know up front what is covered.

A good answer. A plain list of what the monthly plan covers, such as monitoring, fixes and small changes, and what counts as new work, with how that work is quoted.

Red flag. Usage or overage charges that the provider cannot explain or estimate for your volume.

10. If we part ways, what do we keep?

Why it matters. Your workflows, prompts, documents and data are part of how your business runs. You should be able to leave without starting from zero.

A good answer. You can export your data, configurations and documentation, the provider removes its access and your data on exit, and the notice period is stated in the contract.

Red flag. Everything lives in an account only the provider controls.

Frequently asked questions

Should I hire an AI agent provider or buy software and set it up myself?

If you have someone on staff with the time to design, test, secure and maintain an agent, software alone can work. If not, a provider that builds and runs the agent for you can be the better fit. Our explainer on what an AI agent agency is covers the difference.

What should be in writing before an AI agent goes live?

At minimum: the workflow in scope, the systems and permissions the agent will have, the actions that need approval, what is logged, who can switch it off, the support process, and what happens to your data if you leave. Our security approach page shows how we think about these controls.

How many providers should I compare?

Two or three is usually enough to see the difference between clear answers and vague ones. Ask each one the same ten questions and compare the written answers side by side.

Ready to ask these questions about your own workflows?

If you want these questions answered for your business before anything is built, start with an Agent Opportunity Audit.