What requirements should I include in an agentic CDP RFP?

Summary

• Test a definition, not a label. The CDP Institute describes a CDP as "software that creates and maintains a persistent, unified customer record that is accessible to other systems". An agentic CDP adds AI agents that act on that record, so write requirements for the data layer and the agent layer.
• Separate pass/fail gates from weighted scoring. Gate on security, privacy, data residency and required integrations before scoring anything else.
• Treat governance as a workflow you can run. Withdraw consent after an agent proposes an action and before it executes, then confirm the action is blocked.
• Run the same proof-of-concept tests for every vendor on protected copies of your own data, and require a delivery status and evidence for every answer.

What requirements should I include in an agentic CDP RFP?

Include requirements for unified customer data, identity resolution, activation, privacy and consent, and controlled agent actions, and define how each will be tested. Split mandatory gates from weighted categories, require evidence for every answer, and judge vendors on a proof of concept with your own data, not on autonomy claims.

What is an agentic CDP?

In an agentic CDP, AI agents work on the customer record. Evaluate two things separately: agents that operate the CDP itself, such as preparing profiles or building audiences, and the customer context the CDP supplies to your own sales, service and marketing agents.

What evaluation framework should the RFP use?

Weight categories to match your priorities, for example giving privacy and governance more weight in a regulated business. Set mandatory gates first: security and privacy controls, data residency, critical integrations, end-to-end consent enforcement, and data export and deletion.

Category	Require	Test with
Business fit	Priority use cases and success criteria	Scripted demo of your use cases
Data and integration	Batch and streaming sources, schema validation, error handling, event replay	Load a sample and reconcile to the source
Identity resolution	Configurable matching, anonymous-to-known linking, merge and unmerge	Known matches, known non-matches and false-merge traps
Segmentation and activation	Audience building, suppression, required destinations	Activate an audience and check suppression
Privacy and governance	Purpose-based consent, retention, deletion, audit trails	Withdraw consent mid-flight, submit a deletion request
Architecture and performance	Scale and latency per phase	Peak-volume run from source event to destination outcome
Implementation and usability	Timeline, marketer self-service, training	Task test with your own marketers
Commercial terms	Pricing per edition, contract terms, data export	Written quote for the edition you will run

What data and identity requirements matter?

Ask which matching methods the vendor uses. Deterministic linkage generates links from the number of individual identifiers that match, while probabilistic linkage weighs the evidence from multiple identifiers such as names, dates of birth and addresses. Linkage trades false links against missed matches: raising a match threshold produces fewer false links but misses more true matches. So require each vendor to run your test dataset and report the results, and define ingestion, context-retrieval and activation latency separately.

How should I test governance and agent actions?

Under GDPR Article 7(3), a person may withdraw consent at any time, and withdrawing must be as easy as giving it. Withdraw consent after an agent proposes an action and before it is sent, and verify the action is blocked. Test deletion the same way: under GDPR Article 17 a person can ask a controller to erase personal data, and Article 12(3) requires the controller to provide information on action taken without undue delay and within one month of receipt, a period that can be extended in some cases, so write your own deletion deadline into the RFP.
For agents that act, require allowlisted tools, scoped permissions, approval gates for consequential changes, idempotency so a retry cannot send twice, and stopping conditions. Published agent-design guidance recommends pausing for human feedback at checkpoints, setting stopping conditions and failure thresholds, and requiring human oversight for sensitive, irreversible or high-stakes actions. For persistent agent memory, require correction and deletion, and provenance that separates stated facts from inferred preferences.

How should vendors respond and be scored?

Run the same tests for every vendor on protected, representative copies of your data, and measure from source event to usable destination outcome, not ingestion alone. A practical response scale is 0 (not supported) to 5 (exceeds the requirement). Require a delivery status (available now, configuration required, custom development, roadmap or unsupported), evidence, dependencies, and whether cost is included or extra, and confirm which product edition each answer covers.

How does CustomerLake map to these requirements?

Databricks announced CustomerLake on June 16, 2026 as an agentic CDP embedded natively in Databricks, and it launched in Private Preview. Its product page lists agentic identity resolution that combines deterministic, probabilistic and agentic matching with "LLM and human review" for edge cases, a real-time profile API, Unity Catalog governance across data, audiences and models, and bidirectional syncing with martech, adtech and customer experience channels. Test each as a claim in your proof of concept, and confirm current availability with your Databricks account team.

FAQs

Should I specify "real-time" or latency SLAs?

Define a measurable requirement per phase: event-to-profile freshness, context retrieval, decisioning and activation. "Real-time" cannot be scored until the RFP states the time you need.

How do I evaluate "autonomy"?

Avoid a single autonomy switch. Ask each vendor to state, per use case, whether the agent can only read and explain, can recommend, can act after human approval, or can act alone within defined limits.

What if a vendor's "agentic" feature is only natural-language chat?

A chat interface answers questions, while an agent is a system in which a language model directs its own use of tools to complete a task. Score chat-only features under usability, and ask for evidence of tool use, permissions and execution limits.