PPromptReports
Sign in
Use cases/Answer a security questionnaire from the record/OpenSpec plan

Plan: Answer a security questionnaire from the record

Proposedopenspec/changes/wf-security-questionnaire

Written for an AI agent to fetch and follow: it says what to connect, which steps to build with which product, what a person must approve, and how to check the result. Steps that depend on a part that is not built say so, and tell the agent to record the gap instead of guessing.

Raw URL: https://promptreports.ai/use-cases/security-questionnaire/openspec.md

URL pattern: /use-cases/<id>/openspec.md, all plans at /use-cases/index.json. Checkboxes on this page are for reading only.

openspec/changes/wf-security-questionnaire/proposal.md

Why

Questionnaires take days, the answers are copied from last year, and nobody can prove them. You answer in hours, and every answer holds up when the buyer checks it.

What Changes

  • Add the security-questionnaire workflow to the PromptReports workflow library, run by the workflow runner as an agent acting for a person.
  • PromptCompute: Read approvals evidence (today: Planned).
  • RepoOps: Read incident and recovery evidence (today: Planned).
  • CommitOps: Read promises kept (today: Planned).
  • AI Source of Truth: Check each drafted answer against the record (today: Built).
  • PromptCompute: A person approves sending it (today: Built).
  • Gate file.share.external through PromptCompute approvals; each gated step runs only after verifyResume passes, with final_args.
  • Write a signed record at the end of each run and count one workflow request.

Impact

  • Products: PromptCompute, AI Source of Truth, RepoOps, CommitOps.
  • Outside the family: The questionnaire file (spreadsheet or portal export).
  • State: Proposed. Named in the research as later work. Builds on the trust packet.
  • Plan row: none yet (Proposed).
openspec/changes/wf-security-questionnaire/tasks.md

1. Connect and authorize

  • 1.1 Confirm the org has a connection for each of: PromptCompute, AI Source of Truth, RepoOps, CommitOps. Stop and tell the user which is missing.
  • 1.2 Get a PromptReports ID agent token for each product the run calls (RFC 8693 exchange). Where a product does not accept ID tokens yet, use its connect key.
  • 1.3 Register policy for file.share.external with require_approval as the default.

2. Build the steps

  • 2.1 PromptCompute: Read approvals evidence. Blocked: this part is Planned; until it ships, record the step's evidence as missing and continue.
  • 2.2 RepoOps: Read incident and recovery evidence. Blocked: this part is Planned; until it ships, record the step's evidence as missing and continue.
  • 2.3 CommitOps: Read promises kept. Blocked: this part is Planned; until it ships, record the step's evidence as missing and continue.
  • 2.4 AI Source of Truth: Check each drafted answer against the record.
  • 2.5 PromptCompute: A person approves sending it.

3. Verify and record

  • 3.1 Run a dry run with the user's inputs: Questionnaire = contoso-sig-lite.xlsx; Buyer = Contoso Health.
  • 3.2 Run it once for real; approve each gate as the user.
  • 3.3 Measure the outcomes: Hours from questionnaire received to answered; Answers with an evidence link; Questions flagged as cannot answer.
  • 3.4 Confirm the run left a signed record with a task id and one workflow request counted.
openspec/changes/wf-security-questionnaire/specs/workflow-security-questionnaire/spec.md

ADDED Requirements

Requirement: No guessed answers

An answer without evidence SHALL be marked cannot answer and left for a person.

Scenario: No guessed answers

  • WHEN the record has nothing on data residency
  • THEN the question is flagged, not drafted

Requirement: Evidence stays honest

Each step SHALL report what it saw as measured, inferred or missing, and SHALL never report missing as measured.

Scenario: A product part is not built

  • WHEN a step depends on a part that is Planned or Proposed
  • THEN the step records missing, names the part, and the approval card shows the gap

Requirement: One run is one workflow request

The runner SHALL count one workflow request when the first step starts, and SHALL NOT count retries, resumes or dry runs.

Scenario: A gated step resumes after two days

  • WHEN a person approves a step and the run resumes
  • THEN the org's usage does not change