---
title: "Technical due diligence: all 24 rules ยท Agent Wranglers"
url: https://agentwranglers.se/playbook/due-diligence/checklist
updated: 2026-10-27
build: a2a6bdfed830
tokens: 2702
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---
# Technical due diligence checklist
For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Technical due diligence](https://agentwranglers.se/playbook/due-diligence.md).
By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.
Every rule in the technical due diligence playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it. This is a lot to check. [An Expert can check it for you](https://agentwranglers.se/contact.md).
**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers technical due diligence playbook`. In code you write, add a comment next to it with the same link.
## Scope and conduct
- [ ] TDD-1 **Required** [Never sign a review of code you have changed](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct/independent-reviewer.md): The person who signs a due diligence report has made no change to the code under review.
- [ ] TDD-2 **Required** [Work from read-only access and delete copies afterwards](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct/read-only-and-delete.md): Review the target's code and systems with read-only access, and paste no code into outside AI tools without written permission. Delete every copy within 14 days of delivering the report.
- [ ] TDD-3 **Recommended** [Tie every finding to a rule ID and evidence](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct/findings-with-rule-ids.md): Give every finding in a due diligence report the rule ID it breaks, a severity, the evidence and a fix estimate.
- [ ] TDD-16 **Recommended** [Rate every finding on a fixed severity scale](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct/severity-scale.md): Rate each finding on one scale with four levels, defined in the report before any finding. The levels are deal-breaker, fix before closing, fix within 90 days and note.
## Code and ownership
- [ ] TDD-4 **Required** [Build the product from the company's own repository](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/build-from-own-repository.md): Before signing, build and run the product from the company's own repository with read-only access, without help from the founders or the AI builder.
- [ ] TDD-5 **Required** [Confirm the company owns the code](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/code-ownership-rights.md): Match every person and firm that wrote code to a signed agreement that gives the company the rights to it. Report each author without one as a finding.
- [ ] TDD-7 **Required** [Scan the whole history for secrets](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/history-secret-scan.md): Run a secret scanner over every commit and branch of the repository, and test which found secrets still work. Every working secret is revoked before closing.
- [ ] TDD-6 **Recommended** [List the licences of the code and every dependency](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/licence-inventory.md): Produce a bill of materials with an SPDX licence identifier for every package, and assess each copyleft, unknown or missing licence in writing.
- [ ] TDD-8 **Recommended** [Find every part that depends on one person or one tool](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/single-points-of-failure.md): For each critical area, record how many people can change it and which outside tools it cannot run without. Name every area with fewer than two people.
- [ ] TDD-9 **Recommended** [Ask the team to explain the critical paths without AI](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/explain-without-ai.md): Ask a team member to walk through payments, sign-in, permissions and data deletion in the code, without an AI tool. Record whether the explanation matched the code.
- [ ] TDD-10 **Recommended** [Check how the team reviews AI-written code](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/ai-review-practice.md): Sample the last 50 changes merged to the main branch. Record how many had a passing check run and a review by someone other than the author.
- [ ] TDD-17 **Recommended** [Run the tests yourself and read 90 days of pipeline history](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/tests-and-ci-health.md): Run the full test suite on a clean checkout and record the pass rate and line and branch coverage of the critical paths. From the last 90 days of pipeline runs, record the failure rate, the flaky rate and the median duration.
## Security, data and law
- [ ] TDD-11 **Required** [Test the access rules on the running product](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/test-access-rules.md): With two test accounts in the running product, try to read and change the other account's records on every route. Check that no secret key ships to the browser and that payments are confirmed on the server.
- [ ] TDD-12 **Recommended** [Check how personal data is handled](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/personal-data-review.md): Record whether a record of processing exists, which vendors receive personal data without a signed processing agreement, and whether deletion requests reach every store.
- [ ] TDD-13 **Recommended** [Record the product's Cyber Resilience Act duties](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/cra-duties-check.md): State whether the Cyber Resilience Act covers the product. For a product it covers, name who reports exploited holes, the reporting route and the published support end date.
- [ ] TDD-18 **Recommended** [List every AI model the product depends on and its AI Act role](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/ai-dependency-review.md): List every model provider and model version the product calls, with the contract terms on training and data retention, the monthly cost and the fallback. Record the company's AI Act role and risk class for each AI feature.
- [ ] TDD-19 **Recommended** [Time how long it takes to leave each sub-processor](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/sub-processor-exit.md): List every sub-processor with the personal data it holds and the export path for that data. Record the measured or estimated time to move to another provider, and mark each one that has no export path.
## Operations and growth
- [ ] TDD-14 **Recommended** [Measure cost per customer over the last 12 months](https://agentwranglers.se/playbook/due-diligence/operations-and-growth/cost-per-customer.md): Work out the monthly cost of hosting, the database, AI models and other usage-priced services per active customer, for each of the last 12 months.
- [ ] TDD-15 **Recommended** [List what must be rebuilt to grow](https://agentwranglers.se/playbook/due-diligence/operations-and-growth/rebuild-list.md): List every part that must be rebuilt to reach the buyer's growth plan. Give each an effort range and the load or date when it is needed.
- [ ] TDD-20 **Recommended** [Measure delivery with the DORA metrics over 90 days](https://agentwranglers.se/playbook/due-diligence/operations-and-growth/dora-metrics.md): Compute the five DORA metrics from the last 90 days of version control and deploy history. They are change lead time, deployment frequency, failed deployment recovery time, change fail rate and deployment rework rate.
- [ ] TDD-21 **Recommended** [Read 12 months of incidents and measured availability](https://agentwranglers.se/playbook/due-diligence/operations-and-growth/incident-history.md): Collect every incident of the last 12 months with its severity, duration, customers affected and postmortem. Compare measured availability per month with the team's service level objective.
- [ ] TDD-22 **Recommended** [Compare customer service levels with what the system delivers](https://agentwranglers.se/playbook/due-diligence/operations-and-growth/customer-sla-review.md): List every service level promised in customer contracts, with its measure and the credits it owes. Compare each one with 12 months of measured availability, and add up the credits owed but not paid.
## Preparing to sell
- [ ] TDD-23 **Recommended** [Run the buyer's checks on yourself before the review](https://agentwranglers.se/playbook/due-diligence/preparing-to-sell/seller-self-review.md): Before you open the data room, run every rule in this playbook against your own product. Rate each finding on the same scale, and fix or explain each deal-breaker.
- [ ] TDD-24 **Recommended** [Keep a technical data room ready](https://agentwranglers.se/playbook/due-diligence/preparing-to-sell/technical-data-room.md): Keep one folder with the documents a technical review asks for, each with an owner and a date updated within the last 90 days. A script lists any document that is missing or older than that.
## Related playbooks
- [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md) in the Codebase takeover playbook. After the deal closes, take over access, secrets and backups in a fixed order before any change.
- [Using open source](https://agentwranglers.se/playbook/open-source/using-open-source.md) in the Open source maintenance playbook. Licence findings start from the dependency policy. See how a team should vet and track what it uses.
- [AI Act](https://agentwranglers.se/playbook/compliance/ai-act.md) in the Compliance and governance playbook. An AI feature can carry AI Act duties. Check which role the company has and what it must document.
- [Service levels](https://agentwranglers.se/playbook/operations/service-levels.md) in the Operations and observability playbook. Availability promises need targets and measurements. Compare what the team tracks with what customers were told.
## Show the badge on your project
When your project passes every Required rule, you can show this badge on your site or in your README. It links to this checklist, so anyone can run the same checks.
```html
```
```markdown
[](https://agentwranglers.se/playbook/due-diligence/checklist.md)
```