Security questionnaire: an AI workflow that answers from your approved library

What it costs to run

At 30 questionnaire sections a day, 70% covered and 30% gaps, that is about $2.66 a month. If every one took the gaps route it would be $5.41.

Estimated before running, from the prompt each step is sent and an assumed reply length, at list prices for each step's model tier. Want the same numbers for your own agent? Paste its code into the cost calculator.

Sample input

Customer security questionnaire, access and data section: 4.1 Do you enforce MFA for all staff access to production? 4.2 How quickly are leavers' accounts disabled? 4.3 Have you had a security breach in the last 24 months? 4.4 Is customer data used to train AI models?

How the workflow runs, step by step

Sample replies show what each step returns for the sample input above. In the editor, Sim shows the same replies for this input without calling a model; Live runs your own models.

1. 1. Start

   Questionnaire

   One section of the customer's questionnaire starts the run.

   Next: Split questions

2. 2. Agent

   Split questions

   A small model lists the questions with an id and a topic, without answering them.

   Sample reply

   QUESTIONS:
   4.1 · access · MFA for all staff access to production?
   4.2 · access · How fast are leavers' accounts disabled?
   4.3 · incident history · Any security breach in the last 24 months?
   4.4 · AI and data use · Is customer data used to train AI models?
   COUNT: 4

   Next: Answer library

3. 3. Tool

   Answer library

   Searches your approved answers and policies, such as MFA, leavers, encryption and certifications.

   Next: Coverage

4. 4. Router

   Coverage

   Keyword rules send breach, incident, AI model, insurance, subprocessor and data residency questions to the careful draft. Sections about MFA, encryption, leavers or SOC 2 are answered from the library. Anything else gets the careful draft.

   Next: Draft with owners (gaps), Answer from library (covered)

5. 5. Agent

   Draft with owners

   A stronger model drafts answers only from approved text, marks gaps NEEDS OWNER and lists what the security lead must write.

   Sample result

   ANSWER: 4.1 · Yes. All staff access to production requires SSO with phishing-resistant MFA (security keys).
   SOURCE: MFA
   CONFIDENCE: approved
   
   ANSWER: 4.2 · Accounts are disabled automatically within 4 hours of HR marking someone as a leaver, and access is reviewed quarterly.
   SOURCE: Leavers
   CONFIDENCE: approved
   
   ANSWER: 4.3 · NEEDS OWNER
   SOURCE: none (no approved answer for incident history)
   CONFIDENCE: needs owner
   
   ANSWER: 4.4 · NEEDS OWNER
   SOURCE: none (no approved answer for AI data use)
   CONFIDENCE: needs owner
   
   FOR THE SECURITY LEAD:
   • Write the 4.3 answer on breach history; legal reviews the wording before it goes out.
   • Confirm whether any customer data reaches AI model training, including vendors' models, then add an approved answer to the library for next time.
   • 4.1 and 4.2 can go as written.

   Next: Security lead approve

6. 6. Human approval

   Security lead approve

   The run pauses. The security lead fills the gaps and approves before anything goes to the customer.

   Next: Approved answers

7. 7. Result

   Approved answers

   The signed-off answers.

8. 8. Agent

   Answer from library

   For fully covered sections, a cheap model reuses the approved answers, lightly reworded to fit each question.

   Next: Ready to send

9. 9. Result

   Ready to send

   Answers built only from approved text, ready to send. No security lead time.

Why build it as a graph

Questionnaires are mostly repeat questions with a few that carry real risk. A graph answers the repeats cheaply from approved text and keeps the strong model and the security lead for the questions where a wrong answer becomes a contractual claim. Every answer names the library entry it came from.