RFP & Security-Questionnaire Agents

The work is matching, not writing — and the mapping is many-to-one.

Teams scope this as a generation problem because the output is prose. It is a retrieval problem wearing prose as a costume, and mis-scoping it is why the first prototype demos beautifully and fails review.

• Buyers ask the same forty things in four hundred phrasings. "Do you encrypt data at rest?", "Describe your encryption-at-rest controls", "Is customer data encrypted when stored?" all resolve to one canonical claim you already own. The agent's job is to find it, not to compose it.
• The answer already exists somewhere and is not in one place. Past questionnaires, the trust centre, the SOC 2 report, an architecture doc, a Slack thread where the CISO corrected the architecture doc. Consolidating those into one canonical set is most of the value, and it is work an agent can accelerate but not replace.
• Format is a real cost that is genuinely mechanical. A 300-row spreadsheet with merged cells, a portal with dropdowns constrained to Yes/No/Partial/NA, a Word template with a 500-character limit per cell. This part deserves automation and carries almost no risk — do it first and separately.
• Volume is why it gets automated and why it fails. A deal-blocking questionnaire arrives with a five-day turnaround and 280 items, of which perhaps 30 are genuinely new. The 250 are what makes an agent worth building; the 30 are what makes review non-optional.
• Scope your first version to one artefact type. Security questionnaires (factual, verifiable, high liability) and RFP narrative sections (persuasive, differentiating, low liability) are different products with different failure modes. Shipping both at once produces a system tuned for neither.

The answer library is the product, and valid_until is its load-bearing field.

An answer library without expiry dates is a decaying liability that gets more confident as it ages, because reuse frequency is a proxy for popularity, not for truth.

• Model an answer as five things, not one string. The claim, the evidence pointer (control ID, policy section, audit report page), the human owner, valid_until, and the scope caveat that says which product and which region it holds for. A library of strings cannot be governed.
• The scope caveat is where most wrong answers live. "We are ISO 27001 certified" is true for the platform and false for the acquired subsidiary the buyer is actually purchasing. Store the boundary with the claim or the agent will confidently over-scope it.
• Expiry is per claim, not per library. A certification expires on a date you know. An architecture claim expires when the architecture changes, which you learn from a change ticket, not a calendar — so the owner is the mechanism, and their quarterly attestation is the process.
• Retrieval must return the evidence, not just the text. If the reviewer sees only prose, they are reviewing fluency. Hybrid retrieval over past question/answer pairs plus the source documents — the shape in hybrid search and reranking — with the evidence pointer travelling alongside the candidate answer.
• Never let the library learn from itself unsupervised. An approved response gets written back only after a human approves it, and it inherits the expiry of the weakest evidence it cited. Otherwise a single over-scoped answer propagates into every future deal.

Score the difference, not just the similarity.

The dangerous retrieval failure here is not "found nothing". It is "found something that is 0.94 similar and materially different", and similarity ranking is structurally blind to exactly the words that flip an answer.

• One preposition inverts the truth value. "Encrypted at rest" versus "in transit". "Do you support SSO" versus "do you require SSO". "Is data segregated" versus "is data isolated per tenant". These pairs sit close in embedding space and far apart in fact.
• Modal verbs are the second trap. "Can you", "do you", and "will you" ask about capability, current practice and future commitment. Only the middle one is a question about the present, and only the middle one is safe to answer from a library.
• Extract a claim skeleton before matching. Normalise each question to subject, control, condition and scope, then match on that structure rather than on the sentence. The retrieved answer must match on all four or it is a candidate, not an answer.
• Surface the delta to the reviewer explicitly. "Reused from Acme, 2026-03; their question said at rest, this one says at rest and in backups" turns a two-minute re-read into a five-second decision, and it is the reason to keep source questions verbatim in the library.
• Calibrate abstention against real questionnaires, not synthetic ones. Buyer phrasing is idiosyncratic in ways no generated eval set reproduces. Hold out fifty real past questionnaires and measure how often the agent reuses an answer a human would have edited.

Three tiers, and a hard rule about commitments.

Give the agent exactly three moves and forbid the fourth. Most damage comes from a system that was allowed to compose when it should have escalated.

• Reuse. Exact claim match, evidence in date, scope covers this deal. Emit verbatim, cite the source answer and its date, and route to a spot-check queue rather than a full review.
• Adapt. Same claim, different phrasing or format constraint. The model may rewrite the wording; it may not change the claim, add a qualifier or drop a caveat. Flag every adaptation for review with the original beside it.
• Escalate. No in-date evidence, or a scope mismatch, or a claim skeleton that does not match. Return the question with the nearest three candidates and the named owner attached — a routed question is a completed unit of work, and framing it that way is what stops the model from filling the gap.
• Forbidden: forward-looking commitments. "We will implement X by Q3", "we can accommodate that under an enterprise agreement", "this is on our roadmap". These are contract terms, not answers, and they must be typed by a person with authority to bind the company. Make the tool physically unable to emit a future-tense commitment.
• Abstention has to be cheap to be chosen. If escalating means a reviewer starts from a blank cell, the agent's abstention rate will be tuned down until it stops abstaining. Escalation output must include the candidates, the evidence and the gap — grounding is only useful if the ungrounded case has a good landing.

Measure reviewer minutes, not answers per hour — and beware the 92% trap.

This is where the ROI case usually fools people. Throughput is easy to show and is not the number that determines whether you shipped something safe.

• Do the arithmetic that nobody puts on the slide. An agent that fills 300 of 400 items at 92% accuracy has produced 24 wrong answers distributed invisibly among 276 correct ones. A reviewer facing a full sheet of confident prose reads none of them carefully, so the practical accuracy of the delivered document is the agent's accuracy — not the reviewer's.
• Partition the queue by confidence and make the partitions visible. Twenty flagged items get real scrutiny; 280 reused-verbatim items get a spot check. A uniform review queue converts into a uniform lack of review, for the reasons in review queues for agent output.
• Put the evidence pointer next to the claim in the review UI. A reviewer who can click through to the control that proves the sentence reviews the fact; one who sees only the sentence reviews the grammar. This is the same argument as citations and source attribution, with contractual consequences attached.
• The metric that matters is corrections caught before send. Track edits per hundred agent answers, split by tier. A reuse tier with a rising edit rate is telling you the library is going stale before any expiry date fires.
• Count the escalations as a win, not a shortfall. Thirty routed questions with owners attached is a better outcome than thirty confident guesses, and if your dashboard shows escalations as "unanswered" someone will optimise them away.

Both directions of the document are governed — including the one you receive.

Two governance obligations bracket this workflow, and the inbound one is routinely missed because the questionnaire arrives looking like a chore rather than an input.

• Everything you send is discoverable. Keep an immutable record of question, delivered answer, evidence version, model version, approver and timestamp for every response that leaves the building. When a buyer's incident review asks what you told them in March, this is the artefact — the same requirement as audit trails, with a counterparty on the other end.
• The inbound questionnaire is untrusted input. It is a spreadsheet or PDF from outside your organisation, parsed and fed into an agent that has retrieval access to your control documentation. A cell containing instructions is the textbook indirect-injection vector; treat parsed cells as data, and never let this agent hold a send capability.
• Give it read-only access to the library and no ability to write to it. The write path runs through human approval. This one boundary removes the worst failure mode — an agent that answers from an answer it invented last week.
• Buyers increasingly ask whether you used AI to answer. Decide the disclosure position with counsel before the first send, not after a buyer asks, and keep it consistent with what your own procurement side demands of vendors.
• Reciprocity is the useful sanity check. Read your answers as if you were the buyer's security team receiving them. If an answer would not survive your own vendor risk review, it is not ready to send.

Related: sales and GTM agents for the deal context this sits inside, legal agents for the review side, research and synthesis agents for the citation-faithfulness machinery, and disclosure and provenance for the AI-use question buyers now ask.