Security questionnaires

The agent drafts the answers. Security, eng, and legal check theirs.

Keep the questionnaire team-only. Agent connect replaces an answer that overstated the policy. Anonymous readers cannot call the author's agent.

Set it up for your agentHow agent connect works
livesecurity/pebblecourt-questionnaire.md

Pebblecourt questionnaire draft

Owner: Paulina Greco. Buyer: Pebblecourt Insurance. Share: team only.

Draft answers for a vendor questionnaire from Pebblecourt Insurance. Team review only. Someone outside the team cannot open this file, and cannot ask the agent to change an answer.

How to answer

  • Use the sentence in the current policy. Do not use last year's diagram. That diagram is how answer 12 named the wrong region. The policy sentence is the one the buyer should read.
  • If engineering has not confirmed a fact, say so, and name the owner. Do not guess a region.
  • Do not write a control we do not operate. The buyer will test it, and a soft answer will fail the test.

Answers in review

Answer 12. Backups for the EU workspace replicate to us-east-1.

That region is wrong for the EU workspace. The policy names the region. Engineering still has to confirm the live setting, so answer 12 stays open on this draft. Do not close answer 12 from this file. Engineering writes the region down, and then the sentence can change.

Answer 41. Customer data is encrypted end to end, and nobody here can read it.Answer 41: TLS in transit, disks encrypted at rest, as written in the policy.

Still open

  • Backup region for the EU workspace is still with engineering. Answer 12 stays open until they write it down.
  • Finished answers go into the buyer's portal. They are not sent from here. Paulina pastes them into the portal herself. Nobody sends the portal link out from this file.

us-east-1

Tomás Ibarra

Answer 12 names the wrong backup region for the EU workspace.

Irene Vasquez

Use the region in the policy, not the diagram from last year.

end to end

Irene Vasquez

@agent answer 41 overstates our encryption, use the policy text.

agent

Replaced answer 41 with the policy sentence on TLS and disks at rest.

resolved
Start with @agent to ask the agent
ResolveReply
Fictional example: Cobaltfern Analytics answers for Pebblecourt Insurance, team-only in Gander, with a scripted agent connect reply.

How questionnaire drafts get reviewed today

A spreadsheet is the usual working file, and it is easy to mail the whole thing to one reviewer. Comments then live in a copy the agent will not revise.

A shared inbox collects 'looks fine' without saying which answer changed. The buyer portal is where the finished answers go, not where the draft should be argued.

Use the policy text

Paulina Greco's agent drafts answers for a vendor questionnaire from Pebblecourt Insurance, a fictional buyer, on behalf of Cobaltfern Analytics. She sets the share to the team and runs gander watch on security/pebblecourt-questionnaire.md. Irene Vasquez and Tomás Ibarra get the link. No one outside the team can open it.

Tomás highlights answer 12 and says the backup region is wrong for the EU workspace. Irene replies with the region from the policy. That thread stays on the team.

Irene starts a new comment: "@agent answer 41 overstates our encryption, use the policy text." Paulina's agent replaces the answer, replies, and resolves the thread. Tomás sees the policy wording on the same team link. An anonymous reader cannot send that request. Finished answers still go into the buyer's portal.

Who's in the doc

WriterSecurity leadEngineerThe author's agent

Writer SE or sales ops. The link is team-only.

Security lead Checks answers against the written policy.

Engineer Checks the technical answers they can stand behind.

The author's agent Replaces an answer when security uses agent connect.

Reviewers only need a browser. Talk to each other in normal threads. Use agent connect when you want the draft changed.

Agents that fit security questionnaires

Claude CodeThe draft can live in a private repo folder. MCP returns agent connect to that session.
Grok BotA long prose draft from the policy, with agent connect through the Gander MCP server.
CodexCodex can draft from the policy notes in the repo. Agent connect uses MCP.

Check the draft on a team link. Submit the finished answers in the buyer's portal, not from Gander.

See how it works on the homepage