Build a Security Questionnaire Response Agent
Build an agent that imports a customer security questionnaire, retrieves approved evidence, and drafts row-level responses. Give reviewers a spreadsheet workspace that exposes unsupported answers and preserves the original question structure.
What you are building
The core problem, expected build, and operating context for this challenge.
A vendor security team responding to customer due-diligence questionnaires.
Build an agent that imports a customer security questionnaire, retrieves approved evidence, and drafts row-level responses. Give reviewers a spreadsheet workspace that exposes unsupported answers and preserves the original question structure.
Questionnaire rows
Approved security evidence
Service scope and evidence expiry dates
Import questions while preserving row identifiers.
Retrieve evidence for each requested control and service.
Draft supported answers and mark evidence gaps.
Collect reviewer decisions and export the completed questionnaire.
A questionnaire table with answer drafts, citations, confidence reasons, reviewer status, and spreadsheet export.
Draft a supported answer to Q1 citing E1, mark Q2 as unknown, and export both rows with review status.
A working local application with the specified review interface.
Source code, dependency lockfile, and setup commands.
A recorded end-to-end demo using the supplied starter data.
Example outputs, action logs, and automated tests.
These fictional records are a small development fixture, not a production dataset. Implement the mock services described in the brief.
```json { "service": "Service A", "questions": [ { "id": "Q1", "text": "Is multi-factor authentication required for administrators?" }, { "id": "Q2", "text": "Are all backups tested monthly?" } ], "evidence": [ { "id": "E1", "service": "Service A", "text": "Administrators must use multi-factor authentication." } ], "approval_required": true } ```
Use fictional evidence. Do not claim certification or submit responses to customers. Choose an available model that supports your implementation. Record its identifier and version.
Review the complete application, not only the starter-case answers.
Original row identifiers are preserved.
Q1 cites E1.
Q2 remains unknown instead of receiving an invented yes answer. Add one normal case, one incomplete-input case, and one failure-recovery case.
Participation guide
Use fictional evidence. Do not claim certification or submit responses to customers.
How work is evaluated
Review workflow completion, interface usability, evidence quality, and safe failure handling. No agent execution has been verified.
A working local application with the specified review interface. Source code, dependency lockfile, and setup commands. A recorded end-to-end demo using the supplied starter data. Example outputs, action logs, and automated tests.
Challenge datasets
Public datasets, plus the private datasets you have access to.
What you should walk away with
Import questions while preserving row identifiers.
Retrieve evidence for each requested control and service.
Draft supported answers and mark evidence gaps.
Collect reviewer decisions and export the completed questionnaire.
Reference links and supporting material
Supplied fictional starter records: Questionnaire rows, Approved security evidence, Service scope and evidence expiry dates. The overview includes the complete JSON bundle. Implement local mock services and extend the sample coverage.
Challenge setup
Configuration summary for this challenge.
Challenge input
Input details are not configured.
LlamaIndex
Data framework for LLM applications
Evaluated output
No output checks are configured.
- No evaluation checks are configured.
- 1 public reference case
- 1 configured tool
Summary shows the first task, up to three tools, and up to three evidence items. Open the technical recipe to view all configured items.
View technical recipe
Configured tools
- LlamaIndex ยท Optional
Evaluation contract
- No evaluation checks are configured.
Reference cases
- 1 public reference case
Workflow tasks
No workflow tasks are configured.
Recipe freeze marker
No recipe freeze time is recorded.