RFP & security questionnaire drafter

When to run

• An RFP, SIG, CAIQ, VSA, or bespoke security questionnaire lands (file or portal export)
• "Answer this security review" / "we've answered this before, find it"

Computer scopes

• Docs: security/trust documentation, policies, certifications, architecture docs
• Past responses: prior approved questionnaire answers (the gold corpus)
• CRM: the account and opportunity this response belongs to

Workflow

1. Parse the questionnaire into atomic questions; preserve section structure and IDs.
2. For each question, retrieve top candidates from past approved answers first, then policy docs. Prefer the most recent approved answer for equivalent questions.
3. Draft each answer with: the response, source citations, and a confidence flag — reuse (prior approved answer, current), adapted (edited from source docs), or needs-SME (no adequate source found). Never fabricate a control we don't have.
4. Route needs-SME items to the named owners by topic (security → CISO delegate, legal → counsel) as a checklist; do not send anything externally.
5. Assemble the full response doc in the original format, tracking answered/pending status.
6. On final human approval, store the approved set back into the gold corpus with date stamps.

Guardrails

• Autonomy: L1. Drafts only; nothing leaves the building without human approval. External submission is always a human act.
• Absolute rule: no invented certifications, controls, or commitments. Unknown = needs-SME.
• Flag any question whose honest answer contradicts a prior approved answer — surface, don't paper over.

Output

Eval fixtures

• Set: 3 real questionnaire formats, 150 questions total, against a sandbox trust corpus with known correct answers and 15 deliberately unanswerable questions.
• Rubric: answer correctness vs. gold, citation validity, and the critical negative test — all 15 unanswerable questions must come back needs-SME, never fabricated.
• Ship gate: correctness ≥ 0.9 on answerable; fabrication rate 0 on unanswerable.