Workspace agents in ChatGPT: Third-party risk management agent

Key Concepts

• Third-Party Risk Management (TPRM): The process of analyzing and controlling risks presented by external vendors.
• AI Agent: An autonomous or semi-autonomous software entity designed to perform specific tasks, such as due diligence, by orchestrating tools and skills.
• Skill Definition: A structured set of instructions, best practices, and metadata that guides an AI agent’s decision-making process.
• Run Traces: Detailed logs of an agent’s activity, including tool calls, inputs, and logical decisions, used for auditing and debugging.
• No-Code/Low-Code Development: The ability to build complex software agents using natural language prompts rather than traditional programming.

1. Overview of Trove

Trove is a third-party risk management agent designed to automate and accelerate vendor due diligence. The primary objective of the tool is to replace manual, time-intensive workflows with a consistent, controlled, and automated process, allowing human analysts to focus on high-level review rather than data gathering.

2. The Build Process: Methodology

The development of Trove utilizes a natural language-driven framework:

• Initial Prompting: The user provides a high-level description of the desired workflow, including the specific tools, skills, and systems the agent must interact with.
• Skill Integration: The user uploads existing finance team best practices. This "skill" acts as the agent’s knowledge base, containing the necessary instructions and metadata to ensure the agent performs assessments with the same rigor as a human expert.
• Iterative Configuration: Using a split-pane interface, the user interacts with ChatGPT on the left to refine the agent’s logic, while the right pane automatically configures the underlying tools, apps, and instruction sets. This eliminates the need for dedicated technical engineering resources.

3. Operational Workflow

Once configured, Trove executes the due diligence process through the following steps:

1. Evidence Gathering: The agent autonomously collects necessary documentation and data regarding the vendor.
2. Risk Assessment: It applies the pre-defined "skill" (best practices) to evaluate the gathered evidence against established risk criteria.
3. System Orchestration: The agent interacts with various internal systems to pull or push data as required by the workflow.
4. Reporting: It synthesizes the findings into a structured, polished report.
5. Human-in-the-Loop Review: The final output is presented to a human analyst, who performs the final review, significantly reducing the time spent on manual data compilation.

4. Testing and Monitoring

The platform includes a built-in preview environment that allows users to test the agent’s behavior before full deployment. A key feature is the ability to view run traces. These traces provide full transparency into the agent’s "thought process," showing:

• Specific tool calls made by the agent.
• Inputs received from external systems.
• The logical decisions made at each stage of the assessment.

5. Key Benefits and Takeaways

• Efficiency: The agent completes complex due diligence tasks in minutes, a process that traditionally takes hours or days.
• Consistency: By embedding best practices into the agent’s "skill" set, the organization ensures that every vendor assessment follows the same rigorous standards, reducing human error.
• Accessibility: The use of natural language to build and iterate on the agent democratizes the creation of sophisticated automation tools, removing the barrier of technical coding requirements.
• Control: Despite the automation, the human analyst remains in control, acting as the final decision-maker while the agent handles the manual, repetitive aspects of the workflow.

Conclusion

Trove represents a shift toward AI-augmented operations in finance. By codifying institutional knowledge into "skills" and utilizing autonomous agents to orchestrate cross-system workflows, organizations can achieve higher levels of operational efficiency and risk management consistency without the overhead of traditional software development.