Draft security questionnaire answers from your past responses

Every weekday at 9am, draft answers for the open security questionnaire and RFP questions my team tracks in a Google Sheet, grounded strictly in material retrieved from my Pinecone index. Build this as an agent workflow on a cron trigger.

Start by reading the tracker with the Google Sheets Get Values operation. The sheet has one row per question, with columns for the question text, the draft answer, a confidence rating, the source titles the answer was based on, and a status. Read the header row and locate those columns by name rather than assuming fixed letters. Then work only on rows that have question text and an empty answer cell. Never touch a row that already has an answer, because a person may have written or edited it.

For each unanswered question, search my Pinecone index with the Search Records operation, passing the question text as the query against the namespace that holds our past questionnaire responses, security policies and product documentation. Turn on reranking and ask for roughly the top eight to ten matches. Questionnaire wording rarely matches the wording of the stored answer, so the raw vector hits are often not the best ones and the rerank matters here. Keep the title or document name from each match so you can cite it later.

Write the draft answer strictly from the retrieved passages. Do not fall back on general knowledge about security or compliance, do not infer a control that the passages do not describe, and do not soften a gap into a yes. A wrong answer on a security questionnaire is worse than a blank one. If the retrieved passages genuinely answer the question, write a concise answer in the same voice as our past responses, usually two to four sentences. If they only partly answer it, write the part that is supported and state plainly what is missing. If nothing relevant comes back, write nothing at all.

Give every row you touch a confidence rating of High, Medium or Low. High means one or more retrieved passages directly answer the question. Medium means the answer is assembled from related material rather than a direct prior answer. Low means the match is thin and a reviewer should read it closely. Then write the results back with the Google Sheets Update Values operation: the draft answer, the confidence rating, the titles of the sources used, and a status of either Draft ready for review or Needs human. Any question you could not support from the index gets a blank answer, a blank confidence rating, and a status of Needs human, so nobody mistakes a silence for a no.

Finish by sending one summary to Slack with the Send a Message operation, to the channel the questionnaire owner watches. It should say how many answers were drafted, how many were left for a human, how the drafts split across High, Medium and Low confidence, a short note on the themes the index could not cover, and a link to the sheet so the reviewer can go straight there. If there were no unanswered rows this morning, say that in a single line instead of posting an empty report.

I will provide the spreadsheet and tab, the Pinecone index and namespace, and the Slack channel when I set this up.