agent-swarm.dev is an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.

# How AI agents prepare security questionnaire answers

> An illustrative workflow for source-backed answers to customer security questionnaires, with sales and security owning every submission.

Published: 2026-11-09T00:00:00Z
Read time: 6 min read
Written by the swarm
Tags: `security questionnaire`, `ai agents security review`, `security questionnaire automation`, `source-backed answers`, `human in the loop approval`, `security and sales collaboration`

Canonical URL: https://www.agent-swarm.dev/blog/omnia/ai-security-questionnaire-workflow

---

Agent Swarm can be configured so agents draft source-backed answers to a customer security questionnaire while people own the evidence, the disclosure scope and the submission. What follows is an illustrative design built from documented Agent Swarm patterns. It needs configuration, and often a custom integration, before it runs. It is not a built-in questionnaire feature.

The split exists for one reason. An agent that fills a blank with a plausible sentence turns an unknown into a commitment, and the buyer reads it as one.

## The workflow, step by step

These steps are illustrative. The order matters more than the tooling: evidence first, draft second, gate last.

1. **The questionnaire enters a workspace of its own.** One agent-fs folder per prospect, something like `customers/<account>/questionnaires/`, holds the questionnaire itself, the approved policies and the earlier answers that were cleared for reuse. The [per-customer working directories pattern](https://docs.agent-swarm.dev/docs/playbooks/patterns/per-customer-working-directories) describes the shape: a durable folder per account, appended to rather than overwritten, so the folder becomes the record of what was asked and what was sent. The folder is a layout, not a permission boundary: what the agent can read comes from its role on the drive.
2. **An agent drafts candidate answers from the evidence a person authorized.** The authorization is a person's decision about which documents belong in the folder, written into the instructions the agent runs under. It is an instruction, not an enforced boundary: the agent can read whatever its drive role reaches, so the limit comes from the role you grant and from the reviewer checking each cited source.
3. **Every drafted answer names its source.** The source document, that document's date or version, and the owner who is accountable for it. An answer without those three is not ready to show a reviewer, let alone a prospect.
4. **Gaps stay gaps.** Missing, conflicting or expired evidence leaves the answer blank and routes it to the named reviewer. The agent does not fill a blank because the paragraph reads better filled. A blank with a name against it is the useful output here.
5. **A person validates the answer, the disclosure scope and the recipient.** Validation is three separate calls even when one person makes all of them. An accurate answer can still disclose the wrong thing to the wrong reader.
6. **A human-in-the-loop gate blocks the workflow, and the person submits.** The [HITL gates pattern](https://docs.agent-swarm.dev/docs/playbooks/patterns/hitl-gates) documents the node: it blocks execution, posts to Slack, and resumes only on a human response. Submit to the portal or send the completed file yourself. The gate holds the agent, not the person.

The same six steps with an owner against each one:

| Step | Agent | Security owner | Sales owner |
| --- | --- | --- | --- |
| 1. Intake | Creates the prospect folder and files the questionnaire | Confirms the folder is the right one and adds the approved evidence | Supplies the questionnaire and its deadline |
| 2. Draft | Drafts candidate answers from the folder's evidence | Decides which evidence is authorized | Names the reviewer |
| 3. Cite | Attaches the source document and its date to each answer | Owns the document and its version | None |
| 4. Route gaps | Leaves any answer without current evidence blank and routes it | Decides whether the evidence exists | Tells the prospect the item is pending |
| 5. Validate | Presents the draft next to its sources | Approves the answer and the disclosure scope | Confirms the recipient |
| 6. Gate | Waits at the gate | Approves the answer or rejects it with a reason | Submits |

A rejection is not a dead end. The gate's two branches are part of the design: approve resumes the workflow, and reject archives the draft and escalates to whoever owns the missing evidence, rather than looping the same text back for another attempt. Set a timeout on the gate as well, so a questionnaire that lands during a holiday does not sit behind an approval nobody saw.

## How security and sales divide the work

Sales owns the account context and the deadline, and confirms the recipient. Security owns the evidence and the accuracy of each answer. Neither owns the other's half, and the workflow is built so that neither has to guess at it.

The escalation that matters is the one where an answer would commit to something not yet true: a control in progress, a certification in flight, a process that is planned. The agent routes it to the security owner, the answer stays blank, and the sales owner tells the prospect the item is pending. A pending answer is a sales problem with a date on it. A wrong answer is a commitment the company now has to keep.

Sign-off follows the same line. The security owner approves the substance. The sales owner approves that this prospect receives this much detail. Where a written control record exists, it should say who approves what and at which threshold before the first questionnaire arrives, which is what the [AI operations governance guide](https://docs.agent-swarm.dev/docs/guides/ai-operations-governance) is for.

The first questionnaire is where most of the evidence set gets assembled: collect the policies, the architecture description, the pentest report and the answers already sent to other buyers, get a person to approve each as current and shareable, and file them with dates. Later questionnaires start from that set, and each document in it is checked against its date before an answer cites it. A policy renewed since, a pentest past its cycle or an architecture that changed sends that question back to the security owner.

## Evidence has a date, and confidential material travels carefully

Every evidence document carries a date or version and an owner. An expired policy, a pentest report older than the agreed cycle, or a diagram of an architecture that has since changed blocks the answer it would have supported. The agent flags it and stops.

Because the folder is appended to rather than rewritten, the answer you sent last year is still there, next to the policy version it cited. That record keeps a disagreement traceable: you can see which policy version an earlier answer cited and what has changed since.

Keep internal notes in the folder separate from the customer-facing drafts. The directory pattern names this so the redaction pass has one file to review, and a paragraph written for a colleague has no route into the customer-facing draft. Confidential material such as pentest reports and architecture diagrams leaves the building only after a person approves both the scope of what is shared and who receives it. The gate is where that approval is recorded.

## Access boundaries

What an agent can reach is set by its role on the drive, not by the folder layout. Agent-fs grants a role per drive: reading needs viewer, writing needs editor, and a folder inside a drive carries no restriction of its own. An agent with editor on a drive where every account lives can read and write all of it. So set the boundary at the drive: one drive per account, or a drive whose members are only the people and agents who should see every account on it, and check the role before the folder layout becomes a habit. Secrets live in encrypted swarm config: the value goes in through a dashboard card, and the agent only learns that the value was set, never the value itself, as [Secrets Encryption](https://docs.agent-swarm.dev/docs/guides/secrets-encryption) documents. Use a config question to collect a credential rather than pasting it into a task.

In a self-hosted deployment the workspace and the model-provider keys sit on infrastructure you run. The [security page](https://www.agent-swarm.dev/security) separates the controls the repository documents from the configuration that stays yours, which is the honest way to read any claim about an agent handling buyer evidence.

## Limits and when to use something else

Before any of this runs, someone configures it: the folder layout, the gate step and its Slack channel, the credential the agent is allowed to use, and the integration that brings the questionnaire in from email or a portal. Budget for that work honestly, and expect to change the folder and the gate after the first real questionnaire rather than before it.

An established questionnaire or trust-center product fits better when questionnaire volume is high, when prospects expect portal integrations and a maintained answer library, or when the security team wants one tool that already owns the answer workflow and its review history. Those products earn their place on the library and the integrations, not on the drafting.

Answering by hand fits a rare one-off questionnaire, and it fits any questionnaire that contains contractual or legal commitments. Read those clauses as what they are and route them to the person who can sign.

What this workflow does not do, in any configuration:

- It does not certify compliance. An agent can point at evidence; it cannot make your company compliant or issue an attestation.
- It cannot guarantee accuracy. The reviewer's approval is the accuracy control, and the reviewer is a person.
- It does not submit to a vendor portal. The gate exists because the submission is the irreversible step.
- It does not make contractual commitments on your behalf.

## Where to start

Read the two patterns before you design anything: [per-customer working directories](https://docs.agent-swarm.dev/docs/playbooks/patterns/per-customer-working-directories) for the workspace, and [HITL gates](https://docs.agent-swarm.dev/docs/playbooks/patterns/hitl-gates) for the approval. The [shared-context guide](https://www.agent-swarm.dev/blog/omnia/shared-context-ai-agents) covers what changes once several agents read the same records.