# How we get security questionnaires drafted fast

Our agent breaks each incoming security questionnaire into questions, answers them in the vendor's own format from our vetted knowledge base, and marks anything uncertain for a person.

Canonical page: https://themachine.myapps.ai/use-cases/security-questionnaire

Right when a deal is gaining speed, a security questionnaire turns up, and
nothing moves until it is done. Most of what it asks we have answered many
times: how we encrypt, who can access what, how we handle data, which policies
we follow. The catch is the packaging. One buyer sends a SIG, the next a CAIQ,
another a spreadsheet of their own design, and each must be filled in using its
own layout.

So we let an agent on Machine write the first draft, using only our vetted
knowledge base. Below is how we handle our own security questionnaires, along
with what it connects to and the limits we set.

- **Team:** Machine
- **Runs on:** Every questionnaire that comes in
- **Connected systems:** Incoming questionnaire · Knowledge base
- **Mode:** Writes drafts only · security checks it before sending

## The problem

We already hold most of the answers. Encryption at rest, SSO, incident
response, data retention: the same topics appear on almost every questionnaire,
and we have approved wording for each. But no two questionnaires share a format.
Someone has to go through every question, find the approved answer that fits,
and paste it into the vendor's chosen layout, whether that is a SIG workbook, a
CAIQ or a homemade spreadsheet.

The usual fixes only go part of the way. A shared answer library still needs a
person to match each question to it by hand. Recycling the last deal's answers
can sneak in one that no longer applies. A general-purpose AI writer with
nothing to anchor it will happily produce confident answers that are not our
approved ones, and on a security document that is exactly the thing you cannot
allow.

## What we built

On Machine, every questionnaire that arrives sets off an agent. It gets its own
**session**, a fresh cloud computer (a sandbox) for that questionnaire alone,
with access to our knowledge base of approved answers and policy documents. The
agent splits the document into questions and matches each one to our approved
answers and policies. It writes the responses in the vendor's own format,
whether SIG, CAIQ or a custom spreadsheet, and marks for a person anything it
cannot answer with confidence. What comes back is a completed draft that
security reviews before it is returned.

## How it works

### Start when a questionnaire arrives

Whether it comes as an email, a spreadsheet or a link to a portal, a new
questionnaire is the **trigger**, and each one opens a new **session** in a
sandbox of its own. The agent breaks the document into a list of questions,
whatever shape it came in. One questionnaire, one session, one throwaway
computer.

### Anchor it in answers we have approved

Our approved answers and policy docs sit in the agent's **skills** and
**memory**, the playbook it carries into every run. That includes the vetted
reply to each common question, the policies that back them up, and the
standards we map to. The agent answers from this set and nothing else, so every
draft answer is one we have signed off already, never something the model made
up. When a policy changes, we update it, and the agent picks up the new wording.

### Link the questionnaire and the knowledge base

With **connectors**, narrow links to your tools whose keys stay on our servers
so the model never sees a raw token, the agent can:

- **Open the incoming questionnaire.** It reads it from the email, spreadsheet
or portal where it arrived and splits it into single questions.
- **Look things up in the knowledge base.** It checks each question against the
vetted answers and policy docs.
- **Fill in the vendor's format.** Each answer goes back into the SIG, CAIQ or
custom layout the buyer sent.
- **Mark the shaky ones.** Any question without a confident match is set aside
for a person to answer.

### Set the limits

This agent **only drafts**. It fills in the questionnaire and points out where
it is unsure, and it never sends anything. Where the approved set has no
confident answer, it leaves the question for a person instead of guessing. The
finished draft stops at a **human approval gate**, where security reviews it
before anything goes back to the prospect. Credentials are stored encrypted in
the **Secrets Manager** and only handed to the agents you grant them to.

### Get back a completed draft

Once this is running, each questionnaire comes back as a completed draft in the
vendor's own format, every answer taken from our approved set and the uncertain
rows flagged. Security reads it through, answers the flagged questions and
sends it off. The matching and the formatting are handled. Sign-off is still a
person's job.

> **The pattern**
> Each incoming questionnaire is a **trigger** that opens a session with narrow
> **connectors** to the document and our knowledge base. Approved answers and
> policies live in its **skills** and **memory**. The agent drafts and flags,
> and security signs off before anything leaves.

## Guardrails

What this agent writes is a security document built from our own approved
answers, so its reach is narrow and its output stays contained:

- **Isolation.** Each questionnaire gets its own sandbox, used for that one task.
  The session reads the incoming document and the knowledge base it was given,
  and the filled draft is the only thing it sends out.
- **Scoped secrets.** Keys for the questionnaire source and the knowledge base
  are stored encrypted in the Secrets Manager and only handed to the agents you
  grant them to.
- **Human approval gate.** Security checks every completed draft before it goes
  back to the prospect, and any uncertain question waits for a person rather
  than getting a guess.
- **Everything is code.** The agent's setup, skills and permissions are files in
  the repo. They carry version history, and changes go through a reviewed
  **change request** instead of a dashboard toggle.

## The outcome

- **Every questionnaire:** Split up, matched and filled in the vendor's own format
- **Grounded:** Every answer comes from our approved set and nowhere else
- **Drafts only:** Security checks each one before it is sent

Questionnaires now come back as completed drafts in whatever format the buyer
used, each answer pulled from our approved knowledge base and the uncertain
ones flagged. Security spends its time on review and on the tricky questions
instead of hunting and pasting, and no prospect receives anything until a
person has signed it off.