Governing AI agents in procurement and tendering
Procurement agents operate against deadlines that do not move and submissions that cannot be amended. A tender filed with the wrong figure is not a bug report — it is a bid you are bound to or disqualified from. The controls have to be stricter here than almost anywhere else.
Get an Agent Trust Gap BriefWhy procurement is unforgiving
Most agent workloads tolerate a correction cycle. Tendering does not. Submission windows close. Public buyers publish evaluation criteria and are obliged to apply them consistently. An error discovered after submission is usually an error you live with.
Three properties matter more here than anywhere else: deadline integrity, figure integrity, and attribution. Did it go in on time, are the numbers the ones that were approved, and can you prove who authorised the submission. An agent that helps find and draft is enormously useful. An agent that submits unsupervised is a governance failure waiting for a deadline.
What the agent is actually allowed to do
Governance starts by writing down the actions. Not capabilities, not integrations — the specific irreversible things this agent can cause to happen in the world, and what has to be true before each one is permitted.
| Action | Reversible? | Governing question |
|---|---|---|
| Monitor tender portals and classify opportunities | Yes | Useful and low-risk. This is where most of the value is. |
| Extract requirements and build a compliance matrix | Yes | Accuracy matters but nothing is committed. |
| Draft responses from an approved content library | Yes | Provenance — is the content from approved, current source material? |
| Populate pricing | No, in effect | Figures must trace to an approved source. Never model-generated. |
| Submit a bid | No | Binding. Requires human approval and a receipt naming the approver and the exact artifact submitted. |
| Answer a clarification question | No | Becomes part of the record and may bind. Approval required. |
How it fails
These are the failure modes that produce incidents in this workload specifically. Each maps to a control, not to a warning in a runbook.
- Figure fabrication. A pricing cell is filled by generation rather than lookup. The number looks plausible and is wrong. Control: pricing fields bound to an approved source, with generation structurally disallowed in those fields.
- Stale content reuse. The agent pulls a certification or reference from a library entry that has expired. Control: content library entries carry validity dates and expired entries are blocked, not warned about.
- Deadline miss through silent failure. A submission fails and the failure is logged rather than escalated. Control: deadline-aware alerting that escalates to a human on any failure inside the submission window.
- Unattributable submission. A bid is filed and nobody can establish who approved which version. Control: the receipt names the approver and hashes the exact artifact submitted.
- Requirement omission. A mandatory criterion is missed in extraction and the bid is disqualified on compliance. Control: the compliance matrix is generated and then human-verified against the source document before drafting begins.
The controls that hold
Source-bound figures
Pricing and quantitative fields are populated by lookup against an approved source. Generation into those fields is blocked at the schema level, not discouraged in a prompt.
Approval before submission
No bid or clarification leaves without a human approval that produces a signed artifact naming the approver and hashing the submitted document.
Validity-dated content library
Every reusable claim, certification and reference carries an expiry. Expired content blocks the draft rather than generating a warning nobody reads.
Deadline-aware escalation
Inside a submission window, any failure escalates to a human immediately. Outside it, normal retry applies. The clock is part of the policy.
Artifact hashing
The receipt records a hash of exactly what was submitted, so the question 'which version went in' has a definitive answer.
Human-verified compliance matrix
The agent extracts requirements; a person confirms the matrix before drafting. Extraction errors are cheap to catch here and expensive to catch later.
Common questions
Should an AI agent submit tenders automatically?
No. Monitoring, extraction, drafting and assembly are strong uses. Submission should carry human approval, because a submitted bid binds you and the window does not reopen.
How do you stop an agent inventing pricing?
Bind pricing fields to an approved source and disallow generation into them structurally. A model asked not to invent numbers will still occasionally invent numbers; a field that only accepts a looked-up value cannot.
What evidence does a public buyer expect?
Consistency and attribution — that the submission reflects what your organisation approved. Receipts naming the approver and hashing the artifact answer this cleanly.
Can agents handle clarification questions?
They can draft them. Sending should be gated, because a clarification response becomes part of the tender record and can bind you.
What is the highest-value safe use in procurement?
Opportunity monitoring and requirement extraction. It is where the time goes, it is reversible, and it does not commit the organisation to anything.