Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Vendor Management

The vendor command group manages vendor entities and their evidence documents. Vendors represent external providers (CSPs, SaaS, managed services) or internal teams whose controls your system inherits.

List Vendors

pretorin vendor list

Create a Vendor

pretorin vendor create "AWS" --type csp --description "Primary cloud provider" \
  --authorization-level "FedRAMP High P-ATO"

Vendor Types

TypeDescription
cspCloud Service Provider
saasSoftware as a Service
managed_serviceManaged service provider
internalInternal team or shared service

Get Vendor Details

pretorin vendor get <vendor_id>

Update a Vendor

pretorin vendor update <vendor_id> --name "AWS GovCloud" --authorization-level "FedRAMP High"

Delete a Vendor

pretorin vendor delete <vendor_id>
pretorin vendor delete <vendor_id> --force  # skip confirmation

Upload Vendor Documents

Upload SOC 2 reports, Customer Responsibility Matrices (CRMs), FedRAMP packages, or other vendor evidence:

pretorin vendor upload-doc <vendor_id> ./aws-soc2-report.pdf \
  --name "AWS SOC 2 Type II" \
  --description "Annual SOC 2 report covering 2025" \
  --attestation-type third_party_attestation

Attestation Types

TypeDescription
self_attestedVendor’s own assertion
third_party_attestationIndependent auditor report (SOC 2, FedRAMP)
vendor_providedDocumentation provided by vendor

List Vendor Documents

pretorin vendor list-docs <vendor_id>

Once vendors are created and documents uploaded, use the MCP tools or platform to set control responsibility edges:

  • set_control_responsibility — Mark controls as inherited/shared
  • generate_inheritance_narrative — AI-draft inheritance narratives from vendor docs
  • get_stale_edges / sync_stale_edges — Monitor and sync inheritance