OPINION OF THE COURT
Renwick, J.
Plaintiff commenced this wrongful death action as administratrix of the estate of her deceased husband, Jason Aiello. Plaintiff alleges that defendants were negligent in allowing her husband to escape from the emergency room of a psychiatric care unit. At the time, Aiello, a retired New York City Police Department (NYPD) Sergeant, had been admitted to the unit but was waiting for an inpatient bed to become available. After the hospital elopement, Aiello was shot and killed in front of his home during an armed confrontation with the police. Plaintiff sued, among others, the hospital and the security agency retained by the hospital to provide security at the psychiatric care unit. Supreme Court, however, dismissed the claims asserted against the agency on the ground that, as a matter of law, the agency did not owe plaintiff a duty of care in the performance of its contract with the hospital. A threshold issue addressed in this appeal is whether the security service agreement, which disavows any third-party beneficiaries, was rendered unenforceable by the contracting parties’ failure to set forth, in writing, the security agency’s duties.
Factual and Procedural Background
The psychiatric care unit where the elopement took place is part of defendant Richmond University Medical Center (RUMC), a hospital located in Staten Island. The hospital occupies buildings that were formerly Saint Vincents Catholic Medical Centers of New York. RUMC has adjunct facilities at the Bayley Seton Hospital, where it operates several clinics, including the psychiatric care unit at issue here.
[238]*238Security Agreement
Pursuant to several renewed contracts starting in August 2007, defendant Burns International Security Services Corporation (Burns) was retained to supply security guards to the psychiatric care unit at Bayley Seton. Specifically, on August 27, 2007, RUMC and Burns executed a “security services agreement,” which provided that “security services will commence on TBD and will continue until terminated.” With regard to compensation, the agreement delineates four different rates of hourly compensation for four different positions: “Officer I,” “Officer II,” “Officer III,” and “Supervisor.”
Paragraph 1, under “terms and conditions,” defines the “scope of services,” and provides as follows:
“[Burns] will provide services pursuant to this Agreement in accordance with mutually-acceptable, written security officer, patrol officer or alarm response orders (which are incorporated into this Agreement by this reference). [Burns] will not be obligated to perform any duties or services (and will bear no responsibility for duties or services) other than expressly specified in such orders or this Agreement.”
Paragraph 4 provides that RUMC must give Burns notice of any claim “arising out of or relating to this Agreement” within 30 days of the occurrence, and that “[n]o action to recover for any Claim will be instituted or maintained against [Burns] unless said action is instituted no later than 12 months following the date of the occurrence.”
Paragraph 5 (b) provides as follows: “[Burns] agrees to and will indemnify, defend and hold [RUMC] harmless from and against any Claims arising from [Burns’s] performance of the services under this Agreement, but only to the extent the Claim is caused by the negligence of [Burns].”
Paragraph 5 (h) provides as follows: “The services provided under this Agreement are solely for the benefit of [RUMC], and neither this Agreement nor any services rendered hereunder confer any rights on any other party, as a third-party beneficiary or otherwise.”
Paragraph 17 is a merger clause, and provides, in relevant part, that “[n]o representations, inducements, promises or agreements of [Burns] not embodied herein will be of any force or effect,” and “[n]o changes to this Agreement will be binding on [Burns] unless approved in writing.”
[239]*239Testimony Regarding Burns’s Security Duties
Michael Esposito was the director of security and public safety at RUMC. He delegated to his assistant, Vincent Forgione, the negotiation of the security service contract with Burns for Bayley Seton. Forgione entered into the aforementioned contract with Burns after consulting with Linda Paradiso, who was the director of nursing and inpatient services at Bayley Seton. Paradiso told Forgione that she needed security guards to be posted at, at least, three different locations in the psychiatric care unit: Intake (on the third floor); the Comprehensive Psychiatric Emergency Program (C-PER on the first floor) and a supervisory post (on the third floor, down the hall from Intake). Paradiso also recommended that the supervisor should “roam” all areas of the psychiatric unit and provide relief to the guards serving permanent posts so that no post remained unoccupied at any time.
The C-PEP unit was on a portion of the ground floor of the psychiatric care unit. It was next to the Extended Observation Beds (EOB), a separate wing that had individual patient rooms used for short term observation of patients. Although separated by a locked door, the EOB was considered part of the C-PER The C-PEP also contained a waiting room located immediately adjacent to the locked entrance door; this was the “Control Room” from which the RUMC staff would operate the unit. The C-PEP also contained private rooms where patients would be interviewed during triage. Outside of the entrance door to the waiting room was an ambulance bay. RUMC also provided the security officer a small desk inside the C-PEP waiting room that was located against a wall at the opposite end of the room from the entrance door.
According to both Esposito and Forgione, Paradiso directed Burns’s security staff. On several occasions she terminated Burns’s security officers who were not following “rules.” The security officers were required to be licensed by the state. RUMC also provided in-house training for medical staff and security guards for “non-violent” crisis intervention. The guards were also given written materials on “non-violent” crisis intervention and methods for restraining patients.
At the time of Aiello’s incident, there were no written post orders provided to security guards; instead, post orders were communicated verbally to the officers. Each guard was required to be at his post, except the guard at the C-PEP post, who was required to make rounds every 15 minutes, from the C-PEP [240]*240post to the BOB room and back. Each guard was also required to address “crisis and emergencies,” at the behest of the “clinical staff,” including the nurses and doctors. Guards were not allowed to restrain patients, but they assisted the medical staff in such endeavor.
The Patient’s Elopement Incident
On the evening of July 21, 2008, Aiello was brought by his family to Bayley Seton for psychiatric concerns. Around 8:45 p.m., a C-PEP nurse triaged Aiello and directed him to go back to the waiting room. Around 4:15 a.m., Aiello was interviewed by RUMC’s psychiatric resident, Dr. Boiangiu, who also attempted to examine him, but he refused. Around 4:20 a.m., Dr. Boiangiu issued an order admitting Aiello and prescribing various antipsychotic medications for him that were not immediately available. Instead, Aiello was directed to wait in the C-PEP waiting room for an inpatient bed to become available.
Around 6:30 a.m., emergency medical technicians (EMTs) arrived at the C-PEP to transport a patient to a different facility. Allison Rozenkier-Larson, a mental health technician at RUMC, unlocked the door of the waiting room to allow the EMTs to transport the other patient. One of the EMTs reported that Rozenkier was the only staff member present and there was no security in the waiting room. When Rozenkier unlocked the door, Aiello ran past her and the EMTs, and fled the hospital. Charles Brown, Burns’s security guard, was stationed at the C-PEP desk that night, but he was not there when Aiello fled. Brown claimed that, at the time, he had been ordered to remain at the EOB unit to cover for Lisa Hernandez, a mental health technician. Hernandez denied making that request. In addition, Rozenkier stated that only mental health technicians relieve each other.
After fleeing the hospital, Aiello walked to his family’s home and retrieved two handguns. Two NYPD officers arrived at the home, and when Aiello came outside, they directed him to submit to arrest. While they were walking Aiello from the house towards the police vehicle, one of the officers removed a gun from the back of Aiello’s pants, at which time Aiello broke free and pulled out a second gun from the front of his pants. The officers took cover and repeatedly told Aiello to put the gun down, but Aiello fired at them; the officers returned fire and fatally shot Aiello.
Pleadings and Burns’s Motion for Summary Judgment
In December 2008, plaintiff commenced this action against RUMC and Burns, among others. In January 2009, RUMC [241]*241interposed an answer that did not assert any cross claims. In May 2011, RUMC interposed an amended answer generally denying the complaint, raising affirmative defenses, and asserting a cross claim against Burns for indemnification and/or contribution. Burns interposed an answer, inter alia, generally denying the complaint and raising affirmative defenses.
After discovery was completed, Burns moved for summary judgment seeking to dismiss the complaint and cross claims asserted against it, arguing that Aiello was not an intended third-party beneficiary of its security agreement with RUMC. Burns also argued that RUMC’s cross claim should be dismissed because paragraph 4 of their agreement requires RUMC to give Burns notice of the claim within 30 days of its occurrence, and requires RUMC to assert claims against it within 12 months of occurrence, but RUMC served the amended answer asserting the cross claims more than three years after the incident.
Supreme Court granted Burns’s motion and dismissed the complaint and cross claim asserted against it (2012 NY Slip Op 31956[U] [2012]). The court reasoned that it did not need to decide whether the written agreement was enforceable, because Burns did not wholly displace RUMC’s duty to provide security, and there was no evidence “that fully details the scope of Burns’ responsibilities for security” (id. at *4). The court also held that Burns did not launch an instrument of harm, and that there was no detrimental reliance, because it was undisputed that the decedent had no knowledge of what kind of security system RUMC had.
The court also dismissed RUMC’s cross claim for contractual indemnification against Burns because the written agreement was unenforceable, and
“to the extent the cross[ ]claims seek common[-]law indemnification or contribution, they must be dismissed, as the RUMC defendants (and plaintiff) have failed to raise a triable issue of fact as to whether plaintiff was a third-party beneficiary of Burns’ contract or whether Burns had an independent duty of care to plaintiff’ (id. at *5).
Both plaintiff and RUMC appealed the adverse rulings rendered against them.
Discussion
In determining whether plaintiff is entitled to proceed to trial on a negligence theory against Burns, the threshold question is [242]*242whether Burns owed a duty of care to plaintiff (see Espinal v Melville Snow Contrs., 98 NY2d 136 [2002]). To answer this question, we first look to the above-quoted paragraph 5 (h) of the agreement between RUMC and Burns. Again, that provision expressly provides as follows: “The services provided under this Agreement are solely for the benefit of [RUMC], and neither this Agreement nor any services rendered hereunder confer any rights on any other party, as a third-party beneficiary or otherwise.” Thus, plaintiff was not an intended third-party beneficiary of Burns’s contract with RUMC.
Plaintiff, however, argues that the written agreement is unenforceable. Furthermore, plaintiff argues, the third-party duties were orally agreed to by RUMC and Burns. With regard to the service agreement, plaintiff points out that it failed to set forth any of Burns’s duties, and although the contract required the parties to reduce the duties to writing, that never happened. Additionally, plaintiff argues that its merger clause precludes using unwritten extrinsic evidence to establish the scope of duties. We reject plaintiffs suggestion that the security agreement was merely an agreement to agree because Burns’s duties were left for future incorporation in a writing that never took place.
We begin with one of the basic tenets of contract law: the requirement of definiteness (Cobble Hill Nursing Home v Henry & Warren Corp., 74 NY2d 475, 483 [1989], cert denied 498 US 816 [1990]; see also Brown v New York Cent. R.R. Co., 44 NY 79, 83 [1870]). “[A] court cannot enforce a contract unless it is able to determine what in fact the parties have agreed to” (Matter of 166 Mamaroneck Ave. Corp. v 151 E. Post Rd. Corp., 78 NY2d 88, 91 [1991]). Therefore, the parties must make a manifestation of mutual assent sufficiently definite to assure that they are truly in agreement with respect to the material terms of their contract (Matter of Express Indus. & Term. Corp. v New York State Dept. of Transp., 93 NY2d 584, 589 [1999]). In other words, before we can enforce a contractual right, we must first find that the contract is sufficiently definite to allow us to ascertain the terms of the parties’ agreement (Joseph Martin, Jr., Delicatessen v Schumacher, 52 NY2d 105, 109 [1981]; Restatement [Second] of Contracts § 33 [1]). Otherwise, the court in intervening would be imposing its own perception of what the parties should or might have undertaken, rather than confining itself to the implementation of the bargain to which the parties have mutually committed themselves (Joseph Martin, Jr., Delicatessen, 52 NY2d at 109).
[243]*243Accordingly, “a mere agreement to agree, in which a material term is left for future negotiations, is unenforceable” (166 Mamaroneck Ave. Corp., 78 NY2d at 91 [internal quotation marks omitted]; see also Bernstein v Felske, 143 AD2d 863, 865 [2d Dept 1988]). However, “[a] contract does not necessarily lack all effect merely because it expresses the idea that something is left to future agreement” (Four Seasons Hotels v Vinnik, 127 AD2d 310, 317 [1st Dept 1987]). The court shall enforce a contract if the parties have completed negotiations of essential elements, even when “the parties have expressly left . . . other elements for future negotiation and agreement” (id. at 317; cf. Conopco, Inc. v Wathne Ltd., 190 AD2d 587 [1st Dept 1993]).
Applying these principles, we find that the security service agreement here is sufficiently definite to establish that the parties intended to be bound and sufficiently definite to establish the nature of the parties’ agreement. The contract clearly identifies, among other things, the parties, the subject matter of the agreement (security services), and the price to be paid. With regard to compensation, the agreement also delineates ascending levels of compensation for a hierarchy of security officers: “Officer I,” “Officer II,” “Officer III” and “Supervisor.”
Certainly the memorialization of the details of the security service was not an indispensable prerequisite to the performance of the contract, as evidenced by the fact that neither side took any step to raise the issue once the security services (24/7 work schedule with eight-hour shifts) were implemented and renewed several times. Moreover, disputed terms are not to be considered in isolation, but in the context of the overall agreement (Cobble Hill, 74 NY2d at 483). In essence, the parties here bargained for a security scheme comprised of three guards and one supervisor at determinative levels of compensation. Therefore, the provision requiring the parties to reduce the duties to writing does not destroy the definiteness of the security service agreement.
Nor can this Court ignore the fact that at the making of a contract for a right, it may sometimes be impossible to determine details because of the nature of the service. In fact, as hospitals can present complex security considerations, a hospital security officer can expect to confront numerous, and sometimes conflicting, security challenges while on the job. Thus, the changing situation of affairs may indicate that details may also be subject to modification and, therefore, should not be definitely prescribed but should be left to settlement by an agreement or decree at the time the right is insisted upon. [244]*244Furthermore, courts have consistently held that “where [as here] it is clear from the language of an agreement that the parties intended to be bound and there exists an objective method for supplying a missing term, the court should endeavor to hold the parties to their bargain” (166 Mamaroneck Ave. Corp., 78 NY2d at 91; Edelman v Poster, 72 AD3d 182, 185-186 [1st Dept 2010]; Marshall Granger & Co., CPA’s, PC. v Sanossian & Sardis, LLP, 15 AD3d 631, 632 [2d Dept 2005]). Under such circumstances, “[s]triking down a contract as indefinite and in essence meaningless is at best a last resort” (166 Mamaroneck Ave. Corp., 78 NY2d at 91 [internal quotation marks omitted]; Cobble Hill, 74 NY2d at 483).
In this case, there is a clear method for supplying the missing term, the parties’ course of conduct; all other terms were adopted directly from the written agreement. Thus, the only thing that was absent in this contract was a writing evincing the particulars of a nonessential provision, which was later filled in by the parties’ mutual consent and course of conduct. As indicated, the hospital developed a scheme of assigning three guards to permanent posts, and another guard to a semipermanent post, which required that guard to make rounds every 15 minutes. It also appears that they were trained in-house to assist the medical staff in emergencies and crisis, primarily involving the handling of psychiatric patients. Under these circumstances, the security services to be provided were sufficiently specific to ascertain “what was promised” (Joseph Martin, Jr., Delicatessen, 52 NY2d at 109).
Significantly, this Court has held, albeit by implication, that security service agreements that do not expressly specify the services are, nevertheless, enforceable contracts (see e.g. Lebron v Loco Noche, LLC, 82 AD3d 669, 670 [1st Dept 2011]; Rahim v Sottile Sec. Co., 32 AD3d 77, 82 [1st Dept 2006]; see also Buckley v I.B.I. Sec. Serv., 157 AD2d 645 [2d Dept 1990]). For example, in Rahim, the agreement provided that the security company “agreed ‘to furnish Security Officer service,’ ” and that the guards “ ‘shall perform such services as agreed upon by [the security company] and the Client,’ ” which services were not further detailed (32 AD3d at 78). That agreement also expressly disavowed any intent to create third-party beneficiaries (id.). This Court held that the agreement’s language specifically precluded plaintiff from claiming third-party beneficiary status, and that the three Espinal exceptions were inapplicable (id. at 80-82). While not explicitly addressing the agreement’s [245]*245enforceability, by holding that plaintiff was not a third-party beneficiary thereto, this Court implicitly held that the written agreement was enforceable.
Plaintiff’s attempt to distinguish Rahim is not persuasive. Plaintiff points out that the agreement in Rahim merely provided that the security company “shall perform such services as agreed upon by” it and the client (Rahim, 32 AD3d at 78 [internal quotation marks omitted]). Unlike the agreement at issue here, the agreement in Rahim did not require that those services also be set forth in writing. While, in this case, the contract calls for such services to be specified in writing, as indicated, the parties’ course of conduct provided the service requirements.
Furthermore, the law is abundantly clear in New York that, even where a contract specifically contains a nonwaiver clause and a provision stating that it cannot be modified except by a writing, it can, nevertheless, be effectively modified by actual performance and the parties’ course of conduct (see Fundamental Portfolio Advisors, Inc. v Tocqueville Asset Mgt, L.P., 7 NY3d 96, 104 [2006] [“Contractual rights may be waived if they are knowingly, voluntarily and intentionally abandoned. Such abandonment may be established by affirmative conduct or by failure to act so as to evince an intent not to claim a purported advantage” (internal quotation marks and citation omitted)]; All-Year Golf v Products Invs. Corp., 34 AD2d 246, 250 [4th Dept 1970], lv denied 27 NY2d 485 [1970]).
In this case, while the parties do not argue waiver or modification, per se, RUMC does not deny that the services were specified orally, that no party objected or sought to enforce the writing provision, or that the services provided and the price paid were all identical to the written agreement. Moreover, only a few months after the incident in this case, RUMC signed another, identical agreement with Burns, changing only the price paid for the services, and containing the same provision disavowing any third-party beneficiary. Thus, this was essentially a renewal of the first contract.
In sum, we now hold explicitly what was implicit in Ra-him and Lebrón: that security agreements that do not expressly specify services, nevertheless, are enforceable contracts. The specifics of such service are generally not a material provision necessary to the formation of a binding contract, but may be provided later (Rahim, 32 AD3d 77; Lebron, 82 AD3d 669; cf. Buckley, 157 AD2d 645).
[246]*246Our finding of enforceability of the security service agreement disavowing third-party beneficiary status, however, does not end the inquiry as to whether Burns is potentially liable in tort to plaintiff. As this Court explained in Rahim, where “[a] plaintiff was neither a party to [a] contract nor an intended third-party beneficiary thereof, we must look beyond the contract to determine whether there is evidence of any circumstances that, under applicable precedent, could support a finding that [Burns] owed plaintiff a duty of care” (32 AD3d at 80).
Generally, a nonparty to a contract cannot impose tort liability upon a party to a contract for breach thereof (see Church v Callanan Indus., 99 NY2d 104, 111 [2002]; Moch Co. v Rensselaer Water Co., 247 NY 160, 168-169 [1928]). However, there are three exceptions where the contracting party may be liable to a nonparty to the contract for the contracting party’s performance of the contractual obligations: (1) where the contracting party launches a force or instrument of harm; (2) where the plaintiff detrimentally relies on the continued performance of the contracting party’s duties; and (3) where the contracting party has entirely displaced the other contracting party’s duty to maintain the premises safely or securely (see Stiver v Good & Fair Carting & Moving, Inc., 9 NY3d 253, 257 [2007]; Church, 99 NY2d at 111-112; Espinal, 98 NY2d at 140).
This Court finds that none of the Espinal exceptions apply here. It is conceded that the first Espinal exception, launching a force or instrument of harm, does not apply. The second Espinal exception, detrimental reliance, is not applicable because, as Burns correctly points out, this exception requires that the noncontracting party has actual knowledge of the contract between the contracting parties (see Foster v Herbert Slepoy Corp., 76 AD3d 210, 215 [2d Dept 2010]; Wheaton v East End Commons Assoc., LLC, 50 AD3d 675, 677 [2d Dept 2008]). Here, there is no indication in the record that either Aiello or plaintiff had any knowledge about RUMC’s security service agreement with Burns.
As to the third exception, the record demonstrates that Burns did not totally displace RUMC’s duty to secure the facility. It is undisputed that Burns retained a supervisor at the premises at all times. It is, however, also undisputed that RUMC’s management and medical staff retained supervisory authority over the security guards. Indeed, on several occasions Burns guards were fired by Paradiso for not following the RUMC staffs directions. In addition, RUMC required Burns’s staff to complete certain training it provided.
[247]*247We next examine whether any of RUMC’s cross claims against Burns (i.e., contractual indemnification, common-law indemnification or contribution) were properly dismissed. With regard to contractual indemnification, we find that RUMC’s cross claim is barred under paragraph 4 of the agreement. Paragraph 4 requires RUMC to send notice of any claims to Burns’s legal department (in California) within 30 days of the occurrence. It is undisputed that RUMC never did so. Further, RUMC’s reliance upon the incident reports of either Burns’s employees or RUMC’s employees is misplaced; the issue is not whether Burns had actual notice of the incident, but whether RUMC furnished Burns with notice of the potential claim against Burns, as contractually specified, which RUMC did not.
Even if the notice provision had been complied with, RUMC’s cross claim would still not be viable, because it was not timely commenced. RUMC’s original answer was served in January 2009, and its amended answer, asserting a cross claim against Burns, was served in May 2011. Contrary to RUMC’s allegations, its amended answer cannot be deemed to relate back to RUMC’s original answer, because the original answer does not make any allegations pertaining to Burns’s negligence. Thus, RUMC cannot be deemed to have instituted its claim against Burns within 12 months of its occurrence, which was July 2008, as the contract required.
We also find that RUMC’s cross claim against Burns for common-law indemnification was properly dismissed. “Since the predicate of common-law indemnity is vicarious liability without actual fault on the part of the proposed indemnitee, it follows that a party who has itself actually participated to some degree in the wrongdoing cannot receive the benefit of the doctrine” (Trustees of Columbia Univ. v Mitchell/Giurgola Assoc., 109 AD2d 449, 453 [1st Dept 1985]; see Guzman v Haven Plaza Hous. Dev. Fund Co., 69 NY2d 559, 567-568 [1987]; CPLR 1401). Here, given Rozenkier’s conduct described above, the record establishes that RUMC “actually participated to some degree in the wrongdoing” and, therefore, cannot sustain a claim for common-law indemnification against Burns (Richards Plumbing & Heating Co., Inc. v Washington Group Intl., Inc., 59 AD3d 311, 312 [1st Dept 2009] [internal quotation marks omitted]).
Finally, we examine whether RUMC’s cross claim against Burns for common-law contribution was properly dismissed. Generally, a claim for common-law contribution involves the apportionment of liability amongst joint tortfeasors, both of whom [248]*248owed a duty to an injured plaintiff (see Smith v Sapienza, 52 NY2d 82, 87 [1981]). As Bums correctly contends, it has neither a contractual duty under third-party beneficiary status nor an independent duty to Aiello at common law or otherwise. However, one joint tortfeasor may nevertheless seek common-law contribution against another joint tortfeasor even where that tortfeasor did not owe a duty to the injured plaintiff (see Guzman, 69 NY2d at 568 n 5; Garrett v Holiday Inns, 58 NY2d 253, 261 [1983] [“If an independent obligation can be found on the part of a concurrent wrongdoer to prevent foreseeable harm, he should be held responsible for the portion of the damage attributable to his negligence, despite the fact that the duty violated was not one owing directly to the injured person”]).
In this case, contrary to RUMC’s allegations, the record does not provide any grounds for finding Burns negligent. As previously noted, no employee of Burns was present at the time of the escape. The hospital’s mental health technician had a key, and it is not alleged that she lacked independent authority to permit entry or exit. Even if it were to be established that the contracting parties had adopted some protocol requiring a security guard to be present whenever entry to the waiting room was permitted, it was the hospital’s employee who, in the exercise of her sole judgment, elected to open the door. Thus, we perceive no basis for liability on the part of Burns, and RUMC’s cross claim against Burns for common-law contribution was properly dismissed.
Accordingly, the order of the Supreme Court, New York County (Marcy S. Friedman, J.), entered July 23, 2012, which granted defendant Burns’s motion for summary judgment dismissing the complaint and cross claims asserted against it, should be affirmed, without costs.