Back to Prompt Library
Build the complete application
Implementation brief
Inspect the original prompt language first, then copy or adapt it once you know how it fits your workflow.
Linked challenge: Build a Vendor Security Review and Evidence Agent
Format
Code-aware
Lines
60
Sections
11
Linked challenge
Build a Vendor Security Review and Evidence Agent
Prompt source
Original prompt text with formatting preserved for inspection.
60 lines
11 sections
No variables
1 code block
## Who Uses It
A procurement security reviewer assessing a prospective software vendor.
## What You Will Build
Build an agent that organizes vendor security documents, maps evidence to a supplied review checklist, and identifies missing coverage. Produce a reviewer case with follow-up questions and a human-owned decision record.
## Inputs
- Vendor profile and data flows
- Security evidence records
- Review checklist
## Workflow
1. Build an inventory of vendor services and subprocessors.
2. Map evidence to checklist controls and service scope.
3. Identify missing, expired, or contradictory evidence.
4. Prepare follow-up questions and a review case for a human decision.
## Interface
A vendor review workspace with a coverage matrix, source documents, evidence gaps, and reviewer notes.
## Working Demo
Show current access-control evidence for Vendor, request current backup evidence, and identify missing StorageCo coverage.
## Deliverables
- A working local application with the specified review interface.
- Source code, dependency lockfile, and setup commands.
- A recorded end-to-end demo using the supplied starter data.
- Example outputs, action logs, and automated tests.
## Starter Data
These fictional records are a small development fixture, not a production dataset. Implement the mock services described in the brief.
```json
{
"vendor": "Example Vendor",
"processors": [
"Vendor",
"StorageCo"
],
"checklist": [
"access_control",
"backup_testing"
],
"evidence": [
{
"id": "E1",
"processor": "Vendor",
"control": "access_control",
"status": "current"
},
{
"id": "E2",
"processor": "Vendor",
"control": "backup_testing",
"status": "expired"
}
]
}
```
## Constraints
Use fictional security records. Do not perform intrusive testing or certify a vendor.
Choose an available model that supports your implementation. Record its identifier and version.
## Evaluation
Review the complete application, not only the starter-case answers.
- The matrix distinguishes current, expired, and missing evidence.
- Follow-up questions identify the affected processor and control.
- No vendor approval is issued automatically.
Add one normal case, one incomplete-input case, and one failure-recovery case.Adaptation plan
Keep the source stable, then change the prompt in a predictable order so the next run is easier to evaluate.
Keep stable
Preserve the source structure until you know which part of the prompt is actually driving the result quality.
Tune next
Change domain facts, examples, and tool context first before you rewrite the instruction scaffold.
Verify after
Validate one failure mode at a time so prompt changes stay attributable instead of getting noisy.