--- title: "Technical due diligence playbook · Agent Wranglers" url: https://agentwranglers.se/playbook/due-diligence parts: 5 tokens_total: 4214 updated: 2026-10-27 build: a2a6bdfed830 tokens: 1025 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Technical due diligence playbook For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Playbook](https://agentwranglers.se/playbook.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. A technical due diligence playbook for buyers, investors and the reviewers they hire. It turns a review of someone else's software into rules, so a signed report can cite each finding by its rule ID and evidence. It starts with how to run the review. Work from read-only access, stay independent, and rate each finding on one scale that says which ones stop the deal. Then it checks the code and who owns it, security and personal data, and the AI providers the product depends on. It ends with how the team ships and runs it. The last chapter is for the seller. A company that runs these checks on itself first fixes the deal-breakers before a buyer finds them. After the deal closes, the [codebase takeover playbook](https://agentwranglers.se/playbook/codebase-takeover.md) covers the first weeks with the code. **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers technical due diligence playbook`. In code you write, add a comment next to it with the same link. ## Chapters 1. [Scope and conduct](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct.md) · 4 rules · 777 tokens · updated 2026-10-27 Work from read-only access and stay independent of the code you judge. Rate every finding on one fixed scale and tie it to a rule ID and evidence. 2. [Code and ownership](https://agentwranglers.se/playbook/due-diligence/code-and-ownership.md) · 8 rules · 1,197 tokens · updated 2026-10-27 Build the product yourself, confirm who owns the code, list licences and secrets, and check tests, the pipeline and the people the code depends on. 3. [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md) · 5 rules · 899 tokens · updated 2026-10-27 Test the access rules on the running product, check personal data and sub-processors, and record AI provider, AI Act and Cyber Resilience Act duties. 4. [Operations and growth](https://agentwranglers.se/playbook/due-diligence/operations-and-growth.md) · 5 rules · 865 tokens · updated 2026-10-27 Measure delivery, incidents and availability against the promises made to customers, and list the cost per customer and what must be rebuilt to grow. 5. [Preparing to sell](https://agentwranglers.se/playbook/due-diligence/preparing-to-sell.md) · 2 rules · 476 tokens · updated 2026-10-27 Run the same checks a buyer will run before the buyer does. Fix the deal-breakers early and hand over a data room that answers the questions at once. See all 24 rules on one page in the [checklist](https://agentwranglers.se/playbook/due-diligence/checklist.md). This is a lot to check. [An Expert can check it for you](https://agentwranglers.se/contact.md). ## Related playbooks - [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md) in the Codebase takeover playbook. After the deal closes, take over access, secrets and backups in a fixed order before any change. - [Using open source](https://agentwranglers.se/playbook/open-source/using-open-source.md) in the Open source maintenance playbook. Licence findings start from the dependency policy. See how a team should vet and track what it uses. - [AI Act](https://agentwranglers.se/playbook/compliance/ai-act.md) in the Compliance and governance playbook. An AI feature can carry AI Act duties. Check which role the company has and what it must document. - [Service levels](https://agentwranglers.se/playbook/operations/service-levels.md) in the Operations and observability playbook. Availability promises need targets and measurements. Compare what the team tracks with what customers were told.