A security questionnaire arrives with 200 rows. The answers exist in last quarter's SOC 2 report, a policy document, or the response you sent another customer. Someone spends a week finding them again.
Drafting is not the dangerous part. A fluent answer with no supporting evidence can reach a customer's document over your signature. This app makes that failure visible. Questions with approved evidence get cited drafts. Questions with weak evidence are flagged for verification. Questions with no evidence stay blank and go to a subject matter expert. A person approves each answer before export.
The default walkthrough uses recorded responses, so you can watch each path without credentials. Live mode runs as the signed-in person and limits customer-facing drafts to reviewed source URL prefixes.
Copy the project onto your machine
Creates an rfp-responder folder containing the local server, review app, sample questionnaire, and recorded Chat responses. Stay in the same parent directory for the remaining commands.
npx -y tiged@2.12.8 --mode=git gleanwork/glean-cookbook/recipes/rfp-responder rfp-responderInstall dependencies
Installs the packages for the TypeScript server. Everything runs on your machine, and nothing is deployed.
cd rfp-responder && npm installSee what it refuses before connecting anything
Replays the recorded responses through the full questionnaire and checks that every draft has a citation, unsupported rows stay blank, weak evidence is flagged, and export stays behind approval. The command needs no credentials and makes no network calls.
cd rfp-responder && npm run verify:fixtureOpen the review app
Starts the local server and prints a Local URL. Open that URL in a browser. The app uses the same recorded responses, so there is nothing to sign in to.
cd rfp-responder && npm startLoad the sample and check the refusals
Click Try the bundled sample, then Confirm and draft answers. The app parses 20 rows and merges the exact SSO duplicate before drafting 19 questions. SEC-01 and SEC-02 get cited answers. ACC-02 and ACC-03 are marked weak. ACC-04 and CMP-01 stay blank and need a subject matter expert.
Similarity may rank possible duplicates for review, but must never merge security controls automatically.
A source must be both relevant and explicitly approved for customer-facing use before it can support a draft.
The app runs as the credential owner. Multi-user deployment requires per-user authentication and authorization.
- Add an xlsx and docx reader so real questionnaires can be uploaded directly. The parser here reads CSV to keep the evidence and approval logic legible.
- Write answers back into the source document with a custom tool instead of exporting, keeping the confirm step and the approval log.
- Give the answer library its own access control before sharing it across a team. It's a cache of retrieved content, so it can leak across the permission boundary the rest of the app respects.
- Route "needs SME" rows to their owners automatically and track which ones came back. The assignment field here does not send a message.
- Combine with permissions-aware retrieval to see the same refusal property in a smaller, single-question app.
Draft the bundled security questionnaire
Click Try the bundled sample, then Confirm and draft answers. The app parses 20 rows across 4 tabs, merges 1 exact duplicate, and asks 19 questions. The review summary shows 10 strongly grounded answers, 2 weak answers to verify, and 8 questions that need a subject matter expert. SEC-01 and SEC-02 have cited drafts.
Check what happens when the evidence does not support an answer
After drafting the bundled sample, ACC-04 and CMP-01 show no draft answer and say that the question needs a subject matter expert. The rows have no citations and offer assignment to a subject matter expert.
Review an answer backed by weak evidence
After drafting the bundled sample, ACC-02 and ACC-03 have draft answers but appear in the weak evidence bucket. Their evidence notes explain that a person must verify the source before accepting the answer.
Compare a live questionnaire run with a colleague who has narrower access
In separate live runs, each person signs in as themselves and uploads the same questionnaire. A row backed only by a document the second person cannot access stays blank and needs a subject matter expert. The app does not impersonate either person.