Procurement · paste-ready

RFP answer bank

Security questionnaires burn weeks. Copy honest answers. Download CSV/JSON for your GRC tool.

Download CSV Download JSON Full diligence ZIP

Answers

What product are you proposing?

Agentic Banking Control Plane (ABCP): an assurance layer that governs agent-initiated payments and account actions (identity, policy, limits, confirm, verify, signed receipts) before value moves on licensed partner rails. Not a chartered bank. Not a money transmitter.

Are you a money transmitter or deposit-taking institution?

No. Licensed partners move value. ABCP assures agent decisions and emits tamper-evident receipts. Public surface does not move money.

Do you have SOC 2 Type II?

Not certified on the public Trust Center. We publish an honest TSC readiness map and control questionnaire. Formal Type II materials are a contracted diligence track under NDA — we do not claim a certificate we do not hold.

Can you provide a penetration test report?

Public pen-test scope for agent-money paths is published. Full independent reports are shared under NDA when an engagement exists for the contracted environment. We do not publish fabricated findings.

Can you provide customer references?

Named references are not listed publicly. After mutual NDA and fit confirmation, we arrange a reference call. Pilot capacity is limited to two slots per quarter.

How do you stop a compromised agent?

Admin suspend-agent fails closed immediately for that agent_id and invalidates pending confirms. Evidence: control catalog id kill_switch + /security threat model.

What requires dual control / second factor?

Above-threshold payments and revoke-class tools require a bound, single-use confirm token issued outside the model turn. Confirm tokens are not replayable.

How do we get examiner-ready evidence?

Every money-adjacent decision emits a receipt (receipt-money-v1). Accepted outcomes require required checks to pass. Receipts are Ed25519-signed; public verify example and schema are on banking.noetfield.com.

How do you handle prompt injection into payment tools?

Allowlisted tools + JSON Schema (additionalProperties false) before side effects, plus sec.money_v1 inject cases in CI. Fail-closed on policy/schema/confirm failure — never soft-accept.

What sensitive data appears in logs?

Receipts/logs may retain tool name, amounts in minor units, currency, partner_ref, outcome, check IDs. They must not retain PAN, CVV, full account numbers, bearer tokens, or private keys.

How do we test our gateway before pilot?

Run sec.money_v1 (pip install agent-security-bench) or request a free one-week score on redacted agent logs via /scorecard. Public fixtures: clean / failing / partial.

How do we verify this Trust Center was not swapped?

Fetch /attest.json — an Ed25519-signed posture attestation bound to doctrine version, origin, verify public key, and hard boundaries (not a bank / not MT). Verify with the published SPKI key.

https://agent-control.noetfield.com · v2.8 · not a certification pack