The Fine Print

from crewai import Agent, Task, Crew
from langchain_openai import ChatOpenAI
llm = ChatOpenAI(model="gpt-4-turbo", temperature=0)
privacy_agent = Agent(
    role='Data Privacy Assessor',
    goal='Review vendor answers specifically for PII handling, GDPR compliance, and data sovereignty.',
    backstory='Strict privacy officer who ensures data never leaves authorized jurisdictions.',
    verbose=True,
    llm=llm
)
infra_agent = Agent(
    role='Infrastructure Security Assessor',
    goal='Review vendor answers for encryption, access control, and vulnerability management.',
    backstory='Technical security architect evaluating the vendor tech stack.',
    verbose=True,
    llm=llm
)
risk_manager = Agent(
    role='Vendor Risk Manager',
    goal='Synthesize domain assessments into a final Vendor Risk Score (Low, Medium, High) and provide a Go/No-Go recommendation.',
    backstory='Pragmatic GRC leader who balances business needs with security risks.',
    verbose=True,
    llm=llm
)
vendor_questionnaire = """
Q: Do you encrypt data at rest? A: Yes, AES-256.
Q: Do you conduct annual penetration tests? A: No, we rely on automated vulnerability scans.
Q: Is customer data stored outside the US or EU? A: Yes, we have backup servers in regions outside the US/EU.
Q: Are your employees required to use MFA? A: Yes.
"""
privacy_task = Task(
    description=f'Analyze the vendor questionnaire for data privacy and sovereignty risks: {vendor_questionnaire}',
    expected_output='Privacy risk findings.',
    agent=privacy_agent
)
infra_task = Task(
    description=f'Analyze the vendor questionnaire for infrastructure and technical security risks: {vendor_questionnaire}',
    expected_output='Infrastructure risk findings.',
    agent=infra_agent
)
summary_task = Task(
    description='Combine the privacy and infrastructure findings. Assign a Risk Score (Low, Medium, High) and write an executive summary for Procurement.',
    expected_output='Final Vendor Risk Assessment Report.',
    agent=risk_manager,
    context=[privacy_task, infra_task]
)
grc_vendor_swarm = Crew(
    agents=[privacy_agent, infra_agent, risk_manager],
    tasks=[privacy_task, infra_task, summary_task]
)
if __name__ == "__main__":
    print("Initiating Vendor Risk Swarm...")
    assessment_report = grc_vendor_swarm.kickoff()
    print("\n--- Final Vendor Assessment ---\n")
    print(assessment_report)