5 Decisions for a Sealed Agent Tender

1. Define the offer before choosing how to seal it

A sealed tender protects a process, not merely a price field. Begin with a common specification: product or service, quantity, delivery conditions, permitted use, payment terms, validity period and the factors used to evaluate a qualifying offer. An agent should not compare unlike bids because both contain a number.

Publish the decision rule and exceptions in advance. If the cheapest qualifying offer wins, say what qualifies and how ties are handled. If delivery risk or service quality affects the result, define the evidence and method before opening prices. A hidden change in evaluation criteria can undermine the process even when every bid remains confidential until the deadline.

US Federal Acquisition Regulation Part 14 sets out a specific government sealed-bidding framework, including solicitation, submission, opening and award. It is a primary reference for that jurisdictional process, not a rule automatically governing a private agent purchase.

The DN Tender Scenario Pack uses a deliberately narrower synthetic rule: timely commitments, later timely matching reveals, established qualification and a known price. It classifies the records under that rule. It does not adjudicate real procurement exceptions, determine legal authority or award a contract.

Separate the agent’s mandate from the mechanism. The agent may be authorised to prepare or submit an offer within bounds, while a person or organisation remains responsible for making the commitment. Record that authority and the exact offer version that the bidder intended to submit.

2. Choose who must keep the bids confidential

A trusted submission service is one possible design. It receives protected bids, controls access before opening and retains an auditable record. The buyer relies on the service’s controls and the agreed responsibilities of its operators.

The December 2023 MDB electronic-procurement assessment guide addresses confidentiality, controlled access, encrypted submissions, opening times and audit records within its stated scope. Those requirements help frame the technical questions without establishing that a particular commercial platform satisfies them.

Ask who can read a bid before opening, who holds decryption authority and what happens if an operator is unavailable. A design that requires several independent parties to release decryption material changes the trust and availability assumptions. It does not remove the need to establish those parties’ independence, key control and recovery procedure.

Keep transport protection separate from early-access control. A bid sent over an encrypted connection may still be readable by the receiving service. If the promised property is that even the host cannot inspect bids before opening, the design needs evidence supporting that stronger claim.

Document metadata too. Bidder identity, submission time, file size and the existence of a bid may remain visible even when price content is hidden. Decide which of those disclosures the tender permits and whether they affect competition. This article reports no confidentiality test of a live tender service.

3. Use commitment and reveal only with its full conditions

A commitment-and-reveal design separates fixing an offer from disclosing it. During the first phase, a bidder submits a value bound to the bid and suitable secret material. During the later phase, it reveals the information needed to check that the offer matches the earlier commitment.

The Solidity blind-auction example illustrates this pattern on a transparent computing platform. The language’s security guidance separately confirms that even state variables marked private remain publicly visible. It is an educational, development-documentation example, not a complete agent tender system.

The commitment must cover the relevant offer. Binding only the price while leaving quantity, delivery date or licence scope mutable does not fix the commercial bid. Include a tender identifier and unambiguous representation so a commitment cannot be misinterpreted as belonging to a different opportunity or version.

Secrecy also depends on the construction and secret material. A small set of possible prices should not be protected by a predictable, unsalted digest. The implementation needs an appropriate cryptographic design and review, rather than a custom string concatenation described as “sealed.” The DN tool does not generate commitments or check hashes.

Non-revelation is a separate problem. A bidder may fail to reveal, lose its secret or decide that the revealed competition makes participation unattractive. Define the consequence before the tender starts. Deposits or other commitments introduce their own payment, refund and enforceability questions; a mechanism should not silently invent them after the event.

4. Fix the clocks, modifications and outage rules

A tender has more than one relevant time: submission, receipt, commitment cutoff, opening, reveal cutoff, award and offer expiry. Record the timezone, clock authority and event that qualifies as receipt. A request initiated before a deadline can arrive after it.

State whether and how a bid can be replaced or withdrawn before the cutoff. Preserve the relationship between versions and identify the final accepted one. After opening, a proposed change may require a different process. The applicable procurement rules and agreement determine that response; the simulator’s strict exclusions are not a legal rule for every tender.

Prepare explicit cases for a late submission, an unreadable file, a mismatch between commitment and reveal, a missing reveal and an unavailable opening party. Decide whether a system-wide interruption changes the timetable and how all participants receive the same information.

In the synthetic pack, commitments at or before minute10 are timely. Reveals must occur after minute10 and no later than minute20. At a review time after20, an absent reveal is classified under the stated missing-reveal rule. Before the reveal deadline, the result remains provisional.

A real process should retain signed or otherwise appropriate receipt evidence and audit events. The record needs to show what the system received, which version it accepted and when. A bidder’s screenshot of clicking “submit” may be useful evidence without establishing every required receipt condition.

5. Test the process without pretending the cheapest number is a winner

The final decision is how to evaluate the whole protocol. A sealed-bid test should preserve both ordinary and adverse cases, with expected outcomes written before execution. The objective is to establish whether the chosen process enforces its declared rules.

The example has four synthetic bidders. A timely matching qualifying100-unit offer remains in the comparison; a90-unit offer is not revealed, an80-unit offer commits late and a70-unit offer has a binding mismatch. The lowest entered number is therefore not the lowest qualifying offer under the fixture.

The tool reports eligible, excluded and unresolved records plus the lowest known qualifying price. It does not select a contractual winner. Ties, incomplete qualification and unexpired phases require further process. No numerical result establishes that the tender was confidential or free of collusion.

Before a material tender, commission a bounded rehearsal using synthetic bids and the chosen implementation. Retain the expected outcomes, observed results, operator interventions and unresolved failures. The commercial product is a process participants can understand and audit, including what happens when a bid never opens.

Frequently asked questions

Primary sources

1. Federal Acquisition Regulation Part 14: Sealed Bidding. US federal sealed-bidding requirements, submission, safeguarding, opening and award rules within their legal scope. Reviewed 2026-11-11.
2. Guide for Assessment of Electronic Government Procurement Systems. December 2023 MDB assessment guide: confidentiality, controlled opening, deadlines and auditable electronic submissions. Reviewed 2026-11-11.
3. Solidity by Example: Blind Auction. Illustrative commitment/reveal auction mechanics; public contract storage does not itself hide bids. Development documentation, not a procurement implementation. Reviewed 2026-11-11.
4. Solidity Security Considerations: Private Information and Randomness. Direct primary explanation that state variables marked private remain publicly visible; development documentation, not a confidentiality test. Reviewed 2026-11-12.

Related DN research

• Agent-to-Agent Commerce
• Who Gets Paid When Two AI Agents Disagree?