Implementation brief

## Who Uses It
A procurement security reviewer assessing a prospective software vendor.

## What You Will Build
Build an agent that organizes vendor security documents, maps evidence to a supplied review checklist, and identifies missing coverage. Produce a reviewer case with follow-up questions and a human-owned decision record.

## Inputs
- Vendor profile and data flows
- Security evidence records
- Review checklist

## Workflow
1. Build an inventory of vendor services and subprocessors.
2. Map evidence to checklist controls and service scope.
3. Identify missing, expired, or contradictory evidence.
4. Prepare follow-up questions and a review case for a human decision.

## Interface
A vendor review workspace with a coverage matrix, source documents, evidence gaps, and reviewer notes.

## Working Demo
Show current access-control evidence for Vendor, request current backup evidence, and identify missing StorageCo coverage.

## Deliverables
- A working local application with the specified review interface.
- Source code, dependency lockfile, and setup commands.
- A recorded end-to-end demo using the supplied starter data.
- Example outputs, action logs, and automated tests.

## Starter Data
These fictional records are a small development fixture, not a production dataset. Implement the mock services described in the brief.

```json
{
  "vendor": "Example Vendor",
  "processors": [
    "Vendor",
    "StorageCo"
  ],
  "checklist": [
    "access_control",
    "backup_testing"
  ],
  "evidence": [
    {
      "id": "E1",
      "processor": "Vendor",
      "control": "access_control",
      "status": "current"
    },
    {
      "id": "E2",
      "processor": "Vendor",
      "control": "backup_testing",
      "status": "expired"
    }
  ]
}
```

## Constraints
Use fictional security records. Do not perform intrusive testing or certify a vendor.
Choose an available model that supports your implementation. Record its identifier and version.

## Evaluation
Review the complete application, not only the starter-case answers.
- The matrix distinguishes current, expired, and missing evidence.
- Follow-up questions identify the affected processor and control.
- No vendor approval is issued automatically.
Add one normal case, one incomplete-input case, and one failure-recovery case.