Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Use these as inspiration, not a script. The patterns below cover the workflows most customers run on a daily and weekly basis.

​
Vendor intake

The full intake request runs in conversation. You don’t need to say “intake” for any of these; the assistant recognizes the intent. See Vendor intake in chat for the whole flow.

Request a new vendor

I want to start using PostHog for product analytics.
The assistant opens an intake session, reads your portal configuration to see which steps your org enabled, researches PostHog and confirms with you that it has the right company, offers a menu of concrete use cases and in-scope services, surfaces any existing vendor of yours that already covers analytics, runs the screening your portal configures, then walks the inherent risk questionnaire with you one question at a time. Every write asks first.
My team needs a load testing tool and we’re looking at k6. Can we buy it?
Same flow. “Can we buy this” and “my team needs” are intake requests, not questions about policy. The assistant starts the request rather than answering in the abstract.
Is Snowflake approved for us to use?
The assistant resolves the name to a vendor, checks its onboarding status, and reports it. If there’s no approved record, it offers to start the intake rather than stopping at “no”.
We’re about to sign with Mixpanel. Do we already have something that does this?
Vendor matching ranks your existing vendors against the request and surfaces prior relationships, so a duplicate purchase gets caught before the request is filed rather than during review. Web alternatives appear too, if your portal enables them.
That’s the wrong Acme. I mean the payments one, acme.io, not the logistics company.
The assistant takes the correction and re-runs matching or picks another candidate. An unconfirmed match is never carried forward into the request.
Where did my Datadog request get to? Let’s finish it.
The assistant finds the open session, reports which questions are still unanswered or still carrying unconfirmed AI drafts, and resumes the walkthrough there.
What steps does our intake process include?
The assistant reads your portal configuration and reports which steps are enabled and which your org turned off. Useful when you’re not sure whether pre-qualification or web alternatives are part of your flow.
Just add Figma as a vendor record. Skip the intake questionnaire, we already did the review offline.
The only path to a bare vendor record. The assistant states plainly that the vendor will carry no due diligence, waits for you to confirm that, and only then creates it. Requests that don’t explicitly ask to skip intake go through the full flow instead.

​
Reviewing what comes in

Work the pending review queue

Walk me through everything waiting in the intake queue.
The assistant lists pending-review sessions and takes them one at a time: the requester’s use case and services, the enrichment and duplicate readout, the pre-qualification verdict per criterion, and the questionnaire answers with their inherent risk score.
Review the intake request for Marqeta and tell me whether anything looks off.
The assistant pulls the full submission, flags weak or inconsistent answers, and proposes approve, reject, or request-follow-up. The decision is a write, so it waits for your confirmation.
Their data-types answer is too vague. Send it back and ask what customer PII actually flows to them.
The assistant proposes the follow-up request with your question attached, confirms, and returns the session to the requester.
Submitting an intake request is not approval. At the end of the requester flow a vendor record may exist, but it sits in Created status and nobody should start using the vendor until a reviewer decides the request.

​
Portfolio and subprocessor analysis

Which of our vendors use AWS as a subprocessor?

Which of our vendors use AWS as a subprocessor, and what is the current risk tier for each?
The assistant calls query_radar(kind="soc2_nth_party") with relevant aliases in llm_query_terms (AWS, Amazon Web Services, S3, EC2), gets back the list of dependent vendors, then calls query_vendors(kind="risk_summary") for each to surface tier and open findings count.
A major Snowflake outage is happening. Show me every vendor in our portfolio that depends on Snowflake, sorted by criticality.
Same pattern, scoped to Snowflake. The assistant can also pull recent radar alerts for the affected vendors to see if any have already filed incident notifications.
Build me a one-page report of our top 10 highest-risk vendors with their key open findings.
The assistant calls get_report(report_name="portfolio_risk", top_n=10), then drills into each vendor with query_vendors(kind="detail") to extract the relevant findings.

​
Vendor profiles and assessments

Give me a full risk summary for Acme Corp, including any open findings and recent radar alerts.
The assistant calls query_vendors(kind="search") to resolve the name to an ID, then query_vendors(kind="detail") to pull the consolidated profile in a single call.
Summarize assessment cbassmt_abc123 and list the controls that need human review.
The assistant calls query_assessments(kind="detail") and surfaces the control evaluations that are flagged or have open findings, so the reviewer can focus on what matters.
What does the assessment backlog look like? How many are in progress, and who owns each?
The assistant pulls get_report(report_name="review_queue") for the count of open / in-progress assessments and their owners, or get_report(report_name="assessment_metrics") for the rolling-window throughput view. (Assessment statuses are workflow stages such as collecting_documents, analyzing_questionnaire, and review_evals; there is no single in_progress status, so the review-queue report is the right tool for backlog.)

​
Vendor intelligence

Is this company real?

Is Acme Corp a real registered company? Show me the legal entity and where you got it from.
The assistant calls query_vendors(kind="company_registration"), which returns the validated corporate identity from GLEIF, OpenCorporates, and SEC EDGAR (official registered name, status, jurisdiction, and identifiers) with a link to each register’s record. If nothing matched confidently, it says so rather than offering the nearest guess.
What’s the financial health score for Acme Corp, and has it moved in the last year?
The assistant calls query_vendors(kind="financial_health") and reports the score, risk band, confidence tier, pillar breakdown, and 3- and 12-month movement, along with the sources behind each figure and any that were unavailable.
Which of my tier-1 vendors are in the High or Very High financial risk bands?
The assistant resolves the vendor set, then pulls query_vendors(kind="financial_health") per vendor. Ask it to group by confidence tier: a Tier C score is inferred from signals and a Tier A score is computed from filed statements, so the two are not directly comparable and a ranking that mixes them is misleading.
Is the entity on the Acme contract the same one that’s registered and in good standing?
The assistant pulls query_vendors(kind="company_registration") for the registered legal name and status and compares it against the counterparty on the contract. A mismatch between the contracting entity and the registered entity is a real finding, not a formatting difference.

​
Program health and continuous monitoring

Weekly program standup

What is happening across our TPRM program this week? Show me recent assessments, open findings, and radar alerts.
The assistant calls get_report(report_name="org_activity", days=7) with reasonable limits. This is the single most useful prompt for a daily standup or weekly review.
Show me every vendor with overdue findings and their owners so I can chase them.
The assistant calls query_findings(kind="list_detailed") org-wide with a status filter for open and a date filter for past-due, then groups by assignee.
Are there any new radar alerts on our tier-1 vendors in the past 24 hours?
The assistant calls query_radar(kind="alerts") filtered by vendor ID for the tier-1 list, or asks get_report(report_name="org_activity", days=1).

​
Contracts and obligations

What contracts expire in the next 90 days, and which of those vendors have unresolved findings?
The assistant calls query_engagements_contracts(kind="contracts") with the date filter, then for each result calls query_findings(kind="search") scoped to that vendor.
Are there any obligations coming due next month that have not been assigned to anyone?
The assistant calls query_engagements_contracts(kind="obligations") filtered by due date and missing assignee.

​
Bill of materials

Latest SBOM and its components

Show me the latest software bill of materials for vendor Acme and list its components.
The assistant calls query_vendors(kind="search") to resolve the name, then query_vendors(kind="bill_of_materials", vendor_id=…) to pull the current applied BOM and its components in one call.
Does Acme’s current SBOM include any GPL-licensed components?
Same bill_of_materials call, then the assistant filters the returned components by their licenses.
What AI models and datasets are in Acme’s AIBOM?
The assistant pulls the latest BOM and surfaces the machine-learning-model and data components.
Pull the components from Acme’s latest hardware BOM.
The assistant calls query_vendors(kind="bill_of_materials", vendor_id=…) and lists the hardware components.
List every bill of materials we’ve received from Acme over time - which one is currently applied?
The assistant calls query_vendors(kind="bill_of_materials_history", vendor_id=…). The list comes back newest first; the first entry is the applied one.
Has Acme ever shipped a BOM that contained openssl? Show the history.
The assistant calls query_vendors(kind="bill_of_materials_history", vendor_id=…) and checks each BOM’s components for the match, tracing every hit back to its source document.
What these call: query_vendors(kind="bill_of_materials", vendor_id=…) or query_vendors(kind="bill_of_materials_history", vendor_id=…), both read-only and user/org-scoped. See the Bill of Materials API for the full argument list.

​
Write actions, with confirmation

Every write tool requires the assistant to propose the action in chat and wait for your explicit approval. The examples below show the pattern.
Add a note to vendor Acme Corp: following up with their security team next week.
The assistant proposes: “I am about to add a note to Acme Corp with the text ‘following up with their security team next week.’ Confirm?” After your approval, it calls mutate(entity="note", action="add", data={…, "confirm": true}).
Create a finding on assessment cbassmt_abc123 titled “Missing encryption at rest evidence” and assign it to me.
The assistant proposes the finding (title, body, assessment ID, assignee), waits for confirmation, then calls mutate(entity="finding", action="create", data={…, "confirm": true}).
Update the risk tier of vendor Globex to Tier 1.
The assistant proposes the change to the vendor status, confirms, then calls mutate(entity="vendor", action="update", data={…, "confirm": true}) with the relevant status ID.
Log a radar event for Acme Corp: they disclosed a data breach today.
The assistant proposes the event (name, summary, impact type, vendor), waits for confirmation, then calls mutate(entity="radar_event", action="create", data={..., "confirm": true}).
That radar alert about Acme is a duplicate - dismiss it and suppress similar ones.
The assistant proposes the dismissal (alert ID, reason, suppress_similar), confirms, then calls mutate(entity="radar_alert", action="dismiss", data={..., "confirm": true}).
Kick off a reassessment of Acme Corp because of that breach event.
The assistant lists reassessments via query_radar(kind="reassessments") to check for an existing one, then proposes a new reassessment (radar event, vendors, optional plan) and calls mutate(entity="reassessment", action="create", data={..., "confirm": true}). This never opens a case.

​
Tuning the AI

Find controls that flag too often

Which of our controls raise issues most often? I think some are misfiring.
The assistant calls get_report(report_name="control_flag_rates") to rank controls by issue-flag rate across recent assessments, with a volume floor so a control evaluated twice doesn’t top the list. Pass format='csv' if you want it in a spreadsheet.
Go through the flagged issues on assessment cbassmt_abc123 with me and clear the ones that aren’t real.
The assistant walks each flagged evaluation with its evidence, and for the ones you clear calls mutate(entity="eval", action="update", data={..., "is_issue": false, "confirm": true}).
That control keeps flagging vendors who do have MFA. Rewrite its guidance.
The assistant proposes new expectation, evaluation instruction, or evidence requirement text, confirms, then calls mutate(entity="control", action="update", data={..., "confirm": true}). Material edits create a new version rather than overwriting the old one. Re-run the analysis with mutate(entity="assessment", action="rerun", ...) to re-evaluate against the new guidance.

Canned prompts

Nineteen scripted workflows you can invoke by name, including weekly_briefing, submit_intake_request, and tune_control_guidance.

Tool reference

Every route these prompts resolve to, and the parameters each accepts.