The Vendor Dependency Nobody Owned
A logistics firm's agile team is building a customs-documentation feature that transmits shipment data to a government portal. The portal's API specification is versioned and the government has announced a mandatory migration to v3 in nine weeks. The team is on v2. A third-party integration vendor supplies the connector library and has told the team that v3 support is "on the roadmap" with no date. The team's backlog does not contain any v3 work, and the product owner considers it a vendor problem. Separately, the feature handles shipper names and addresses, and the firm's data-protection officer has asked for a data-flow assessment that has not been scheduled. The team has four sprints before the migration deadline and is currently committed to customer-facing enhancements.
1. How do you get the v3 migration onto the backlog, and how do you sequence it against the enhancements?
Read the worked answer
The migration is a hard external deadline with a dependency the team does not control, which makes it a risk to be managed now, not a vendor problem to be delegated. Nine weeks is roughly four sprints, and the vendor has given no date, so the schedule risk is dominated by the vendor, not by the team's effort.
First, I would make the risk concrete and owned. Add a backlog item for the v3 migration with an explicit risk note, and identify a single owner on the team, not the product owner alone, to track the vendor. Ask the vendor for a written commitment date and an interim milestone, and escalate through procurement or the account relationship if none is given.
Second, I would sequence defensively. The team should start the work that is independent of the vendor now: mapping v2-to-v3 field changes, updating the data contract, and building an adapter seam so the connector can be swapped. That work reduces the blast radius if the vendor slips.
Third, I would renegotiate the enhancement commitment with the product owner and stakeholders, presenting the deadline and the vendor uncertainty as a scope trade-off. Some enhancements must move; pretending otherwise transfers the risk to the deadline.
2. The data-protection assessment is unscheduled. What is the right move?
Read the worked answer
An unscheduled data-protection assessment on personal data is a compliance exposure, and in an adaptive delivery context the correct move is to pull it forward as a constraint on design, not to treat it as paperwork after build.
I would schedule the assessment immediately, before further design work on the data flow, and involve the data-protection officer in refinement for the affected stories. The assessment may change what data is transmitted, where it is stored, and what is logged, and those decisions are far cheaper to make now than after the feature is built.
I would add acceptance criteria to the relevant stories reflecting the assessment's outcomes, and record the assessment as a dependency in the same way as the vendor migration. Both are external constraints with real deadlines, and both were invisible in the backlog. The pattern to fix is that compliance and external dependencies are not entering refinement, so I would add a standing check in refinement asking whether a story touches personal data or an external interface.
3. The vendor misses the date. What was the team's preparation worth, and what should they do?
Read the worked answer
The preparation determines whether the miss is a crisis or a manageable delay. If the team built the adapter seam and mapped the field changes, the remaining work is swapping the connector or implementing a minimal direct client for the changed fields. If they did nothing and waited, they now have four sprints of work compressed into whatever time remains.
On a miss, I would first establish the facts: which v3 behaviors are actually required for compliance, and whether a minimal direct integration covering only the mandatory fields is feasible. Often the regulatory requirement is narrower than the full API surface, and a thin compliant path can bridge the gap.
I would then bring the product owner, the data-protection officer, and the vendor account owner into one decision meeting with options: bridge with a minimal client, negotiate a deadline extension with the government portal if permitted, or reduce shipment volume through the affected path. Each option has a cost, and the decision belongs to the business, not the team.
Finally, I would run a retrospective on how a nine-week external deadline stayed off the backlog, and change refinement so external deadlines and vendor dependencies are surfaced at intake.