How to Write an RFP for Agentic AI

A joint secretary's office needed officers to draft replies to parliamentary questions from a sealed set of circulars, on a network that was not supposed to touch the public internet. The first RFP draft, written from a chatbot template a consultant reused, said 'AI-powered conversational interface, latest technology, 99.9% uptime, cloud or on-prem as per buyer choice'. Four bidders ticked every box. One of them would have sent every draft through a foreign model host. The marks would not have noticed.

This article starts the tender cluster. It is a field template for Indian public institutions that want agentic systems — software that retrieves, plans a next step, and calls tools — not a search bar with a smiling avatar. It is written so a purchase officer and a CISO can share one document. It is not a complete NIT. You will still attach your GCC, your GeM-or-CPPP choice, your EMD maths, and your finance concurrence.

Prcept AI sells on-prem and air-gapped agents, is DPIIT recognised, and does not train on customer data. We will win some of the RFPs written this way and lose others. That is the point. A good RFP is a filter, not a souvenir for a preferred vendor.

Not legal advice. GFR, GeM, state codes, DPDP and GIGW sit above this template. If a citizen will see a web surface, read the GIGW/STQC path before you add a widget clause.

Write the job, not the fashion

Open with three to seven workflows. Each workflow has an actor (section officer, call-centre agent, faculty), a system of record (eOffice, a PG portal, a student MIS), an input, an output, and a human who still signs. If you cannot name the signer, you are not ready to automate the act. You may still automate the draft.

Ban the words latest, state-of-the-art, GPT-like, and sovereign unless you define them in the same sentence. Sovereign in this template means: inference and retrieval complete on infrastructure the department controls; no training on departmental data; no transfer of personal data to an undisclosed host. If you mean something else, write something else.

State what success looks like in numbers a committee can argue about: citation rate on a held-out set of circulars, time-to-first-draft, refusal rate on out-of-corpus questions, percentage of drafts accepted with only light edit. If you have a pilot report, attach it. If you do not, attach twenty redacted examples of today's work.

RFP sections that change when the object is an agent

Usual IT RFP heading	What to write instead	Why
Scope: chatbot / NLP module	Scope: named workflows, tools the agent may call, tools it must never call	Agents without a tool allow-list become unsupervised staff
Deployment: cloud/on-prem optional	Deployment class: hosted-India / on-prem / air-gapped, with a definition of each	'Optional' is how a hosted hop wins on price
Security: ISO 27001 preferred	ISO if you will score it, plus residency, outbound schedule, no-training, CERT-In logs	ISO is not a topology
Acceptance: UAT sign-off	Acceptance: eval pack scores, isolation drill, deletion certificate, officer shadow week	UAT on a demo tenant proves a demo tenant
AMC: 24x7 support	Support: hours, jump-host rules, no standing tunnel, media updates	24x7 often means a foreign NOC you did not disclose
IP: all work product to buyer	IP: buyer keeps corpora and eval; vendor keeps runtime; no training on buyer data	A greedy IP clause can force a dishonest bid or a hostage

Architecture rows an evaluator can fail

Do not write 'must support air-gapped deployment' as a yes/no. Write the rows. Where do weights live. How do they arrive (hashed media or named internal registry). What is the licence mechanism with the WAN dead. What is the time source. What is the DNS. What destinations will the runtime attempt in 24 hours of isolation. Empty is acceptable. 'Will confirm after award' is a fail.

Write the identity row. The agent acts as the officer, a service account, or a monster. Only the first two are allowed, and the second needs a tiny privilege. Joiner-mover-leaver must be named.

Write the tool row. List permitted integrations (read-only circular store, ticket system, eOffice draft). List forbidden ones (payment, FIR registration, anything that moves money or liberty) unless a later change-control adds them.

Write the training row in one sentence you will not let them weasel: 'The contractor shall not train foundation models or shared embeddings on the department's prompts, documents, or logs. Fine-tuning, if any, happens only on department metal, on a corpus the department lists, and is deleted on request.' If a bidder cannot sign that, they are a different product.

Write the log row: 180-day ICT logs in Indian jurisdiction in the CERT-In vocabulary, plus an application log that can reconstruct which chunk and which tool produced a draft. Without the second, you cannot investigate a hallucination.

• Processor table: every host that can see text, including 'APIs'.
• Subcontracting: prior approval; no silent model host (see the GCC piece).
• GIGW: if a public widget exists, it is in scope of the website certificate path.
• DPDP: who is fiduciary, who is processor, what the purpose is. The Act does not define sovereign AI. Do not ask bidders to certify that it does.

How to evaluate without being captured

Split eligibility from technical from commercial in the usual way. In technical, use a matrix that can fail isolation even if the UI is pretty. A companion piece in this cluster will go deeper on the matrix; the minimum here is: workflow fit, isolation, identity, tools, eval design, language, operations, and evidence quality.

Demand a live demonstration on your VLAN or a throwaway VLAN you control, using your redacted pack, not their polished corpus. Score citation and refusal, not fluency.

If you ran a pilot with one firm, you may use the report as the spec. You may not write the eligibility so that only their CIN qualifies. Familiarity is not a PAC.

Commercials should price units that exist: workflows stood up, isolation drill, language pack, support year, extra node. Seat licences for an agent that reads a corpus are often the wrong unit. Ask for a ceiling on change-requests so the winner cannot starve the eval work.

1. Publish the eval pack (redacted) with the RFP or on a controlled portal.
2. Publish the scoring weights. If isolation is 5% and UI is 40%, you will buy a widget.
3. Forbid product names in the spec. Describe outcomes.
4. Require a statement of third parties on day one of technical.
5. Keep a right to re-mark if the OEM or the model host changes after opening.

Boilerplate to delete from the chatbot template

Delete '99.9% uptime' unless you have a measurement point that includes isolation. An air-gapped box that is up but cannot draft because the licence daemon died is not up.

Delete 'unlimited users' if your identity model cannot join and leave officers.

Delete 'AI/ML engine of bidder's choice' if that choice includes an undisclosed foreign host.

Delete 'all data belongs to bidder for improvement of models'. That clause is how you purchase a leak.

Delete 'cloud native microservices' as a scored item. It is a fashion. Score operability in your SDC.

Channel and procedure still exist

Decide GeM versus CPPP versus a state portal using your manual and GFR Rule 149 habits, not using a vendor's preference. If you are on GeM, write a spec the category can hold or petition for the right tree. If you are off GeM, write why.

Decide advertised versus limited versus a drawal from a live panel. A good agent RFP is usually advertised or a mini-bid among empaneled firms. A one-firm preferred list after a pilot is the path we already warned you off.

Put EMD, turnover and experience at levels that do not accidentally ban every DPIIT firm if you wanted startups, and do not pretend a two-person shop can run a national rollout if you did not. Relaxations are clauses, not moods. Name Udyam or DPIIT if you mean them.

Give a realistic calendar. Isolation demos take longer than hosted ones. If you need the thing before a session of the House, start the RFP earlier, or buy a narrower workflow.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

This RFP is too hard; nobody will bid.

Then you will learn that the market cannot meet your isolation need, which is information. Softening the rows to harvest bids is how you harvest incidents. You can narrow workflows instead of softening controls.

We should name a model family so bidders are comparable.

Name capabilities and evals. Naming a family is how you PAC a fashion. If you must constrain provenance, write 'weights deliverable on media, hash published, no mandatory vendor API'.

Legal wants unlimited liability and all IP.

They can ask. They will get a dishonest price or an empty field. Split IP as in the table. Cap liability in a way finance will still sign. Counsel should see the agent risk (wrong draft) and not only the software-licence folklore.

We already have an empanelment; we do not need an RFP.

Then write a mini-bid among the panel with these rows. An empanelment without a second step is how a hosted bot enters an air-gap building. See the RC versus panel comparison.

A four-week RFP writing room

Lock a room with purchase, the user department, CISO/SDC, and someone who will live with the eval. No vendor in the room for week one.

1. Week 1: list workflows, signers, systems of record, deployment class, public-or-not. Kill fashion words.
2. Week 2: write isolation, identity, tools, training, logs, processors, GIGW-if-public. Attach a draft eval pack.
3. Week 3: write eligibility (with any DPIIT/Udyam hooks you truly want), matrix weights, commercials units, subcontracting, acceptance. Choose the channel.
4. Week 4: legal and finance. Remove PAC language. Publish. Brief the committee that 'latest AI' is not a mark.

How this shows up in the file

Purpose clause you can paste: 'To obtain an agentic system that drafts [workflows] from [corpus] for [officers], running in a [on-prem / air-gapped] class as defined in Schedule A, without training on departmental data, subject to evaluation on the published pack. The system proposes; named officers dispose. This RFP does not seek a proprietary article and does not certify any model family.'

Schedule A should define hosted-India, on-prem, and air-gapped in testable sentences (default route, licence, media, support tunnel). If you cannot write Schedule A, you are not ready to issue.

This note is an aid. The live GFR, GeM terms, DPDP, GIGW and your counsel prevail.

This article is informational field guidance for Indian public institutions and their vendors, not legal, tax, procurement or engineering advice. Confirm the live circular, RFE, GCC, GeM term, state G.O. and your counsel before you file anything. Incentives, ceilings and portal screens change.