Vendor risk review

Step 01

Define and Align

Review representative examples and annotate the fields that need to change. Explain the edge cases to teach your team’s policy.

Output schema

RouteChoose one: Next review step under the supplied vendor policy.
security_review
standard_onboarding
request_information
Missing informationList of values: Unresolved facts needed to select a review route.
ExplanationText: Policy and evidence supporting the route.

app.sutro.sh/functions/vendor-risk-review

Collecting feedback · 1/3

Route the vendor assessment according to the supplied internal policy.

Example 1 of 3

Certification does not waive review

Model input

Policy: Synthetic vendor policy. Restricted customer data requires security review before onboarding. A vendor with no customer data and no production access may follow standard onboarding. If data scope or production access is unknown, request information. Certifications alone do not waive these rules.
Vendor assessment: Vendor: Harbor Analytics (synthetic). Receives restricted customer records. No production access. Questionnaire reports a security certification.

Model output

Route

Missing informationMultiple values

Explanation

Why? Optional guidance

Step 02

Model Sweep

Compare models on the same expert annotations, then choose a quality–cost tradeoff.

Compare models on expert agreement and cost. The interactive chart uses illustrative measurements.

Illustrative sweep · select Value or Best to use that model in your function.

Step 03

Deployment

Call Sutro Functions like any other software. Swap the model as soon as something more performant is released.

Selected modelWaiting for sweep results.

Real-time

import sutro as so

input_data = {
    "policy": "Synthetic vendor policy. Restricted customer data requires security review before onboarding. A vendor with no customer data and no production access may follow standard onboarding. If data scope or production access is unknown, request information. Certifications alone do not waive these rules.",
    "vendor_assessment": "Vendor: Harbor Analytics (synthetic). Receives restricted customer records. No production access. Questionnaire reports a security certification."
}

result = so.run_function(
    "vendor-risk-review",
    input_data,
)

curl --fail-with-body -X POST "${SUTRO_API_URL%/}/v1/functions/vendor-risk-review/run" \
  -H "Authorization: Key $SUTRO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "input": {
    "policy": "Synthetic vendor policy. Restricted customer data requires security review before onboarding. A vendor with no customer data and no production access may follow standard onboarding. If data scope or production access is unknown, request information. Certifications alone do not waive these rules.",
    "vendor_assessment": "Vendor: Harbor Analytics (synthetic). Receives restricted customer records. No production access. Questionnaire reports a security certification."
  }
}'

Batch

import sutro as so

job_id = so.batch_run_function(
    name="vendor-risk-review",
    data="vendor_risk_review.csv",
)
results = so.await_job_completion(job_id)

curl --fail-with-body -X POST "${SUTRO_API_URL%/}/v1/batch-inference" \
  -H "Authorization: Key $SUTRO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "model": "vendor-risk-review",
  "inputs": [
    {
      "policy": "Synthetic vendor policy. Restricted customer data requires security review before onboarding. A vendor with no customer data and no production access may follow standard onboarding. If data scope or production access is unknown, request information. Certifications alone do not waive these rules.",
      "vendor_assessment": "Vendor: Harbor Analytics (synthetic). Receives restricted customer records. No production access. Questionnaire reports a security certification."
    }
  ]
}'