Your vendor review asks where the data lives. It doesn't ask what the agent can do.
Most vendor security reviews were written for tools that store data. AI agents also act: they read content nobody vetted, hold credentials, and call tools. A questionnaire that stops at "where is data hosted?" and "do you have SOC 2?" can…