You in fact have no idea how "innocuous" the Drata agent is. You know only what Drata tells you. It would be grossly irresponsible for a contractor to rely on

You in fact have no idea how "innocuous" the Drata agent is. You know only what Drata tells you. It would be grossly irresponsible for a contractor to rely on one client's assurances about what a third party told them its software did, and expose other clients' data to errors or abuse by that third party. Or their own personal data, for that matter.