Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Use these as inspiration, not a script. The patterns below cover the workflows most customers run on a daily and weekly basis.

​
Vendor intake

The full intake request runs in conversation. You don’t need to say “intake” for any of these; the assistant recognizes the intent. See Vendor intake in chat for the whole flow.

Request a new vendor

I want to start using Northwind Analytics for product analytics.
The assistant opens an intake session, reads your portal configuration to see which steps your org enabled, researches Northwind and confirms with you that it has the right company, offers a menu of concrete use cases and in-scope services, surfaces any existing vendor of yours that already covers analytics, runs the screening your portal configures, then walks the inherent risk questionnaire with you one question at a time. Every write asks first.
My team needs a load testing tool and we’re looking at Loadspin. Can we buy it?
Same flow. “Can we buy this” and “my team needs” are intake requests, not questions about policy. The assistant starts the request rather than answering in the abstract.
Is Acme approved for us to use?
The assistant resolves the name to a vendor, checks its onboarding status, and reports it. If there’s no approved record, it offers to start the intake rather than stopping at “no”.
We’re about to sign with Mixpanel. Do we already have something that does this?
Vendor matching ranks your existing vendors against the request and surfaces prior relationships, so a duplicate purchase gets caught before the request is filed rather than during review. Web alternatives appear too, if your portal enables them.
That’s the wrong Acme. I mean the payments one, acme.io, not the logistics company.
The assistant takes the correction and re-runs matching or picks another candidate. An unconfirmed match is never carried forward into the request.
Where did my Datadog request get to? Let’s finish it.
The assistant finds the open session, reports which questions are still unanswered or still carrying unconfirmed AI drafts, and resumes the walkthrough there.
What steps does our intake process include?
The assistant reads your portal configuration and reports which steps are enabled and which your org turned off. Useful when you’re not sure whether pre-qualification or web alternatives are part of your flow.
Just add Figma as a vendor record. Skip the intake questionnaire, we already did the review offline.
The only path to a bare vendor record. The assistant states plainly that the vendor will carry no due diligence, waits for you to confirm that, and only then creates it. Requests that don’t explicitly ask to skip intake go through the full flow instead.

​
Reviewing what comes in

Work the pending review queue

Walk me through everything waiting in the intake queue.
The assistant lists pending-review sessions and takes them one at a time: the requester’s use case and services, the enrichment and duplicate readout, the pre-qualification verdict per criterion, and the questionnaire answers with their inherent risk score.
Review the intake request for Marqeta and tell me whether anything looks off.
The assistant pulls the full submission, flags weak or inconsistent answers, and proposes approve, reject, or request-follow-up. The decision is a write, so it waits for your confirmation.
Their data-types answer is too vague. Send it back and ask what customer PII actually flows to them.
The assistant proposes the follow-up request with your question attached, confirms, and returns the session to the requester.
Submitting an intake request is not approval. At the end of the requester flow a vendor record may exist, but it sits in Created status and nobody should start using the vendor until a reviewer decides the request.

​
Portfolio and subprocessor analysis

Which of our vendors use AWS as a subprocessor?

Which of our vendors use AWS as a subprocessor, and what is the current risk tier for each?
The assistant calls query_radar(kind="soc2_nth_party") with relevant aliases in llm_query_terms (AWS, Amazon Web Services, S3, EC2), gets back the list of dependent vendors, then calls query_vendors(kind="risk_summary") for each to surface tier and open findings count.
A major Northwind outage is happening. Show me every vendor in our portfolio that depends on Northwind, sorted by criticality.
Same pattern, scoped to Northwind. The assistant can also pull recent radar alerts for the affected vendors to see if any have already filed incident notifications.
Build me a one-page report of our top 10 highest-risk vendors with their key open findings.
The assistant calls get_report(report_name="portfolio_risk", top_n=10), then drills into each vendor with query_vendors(kind="detail") to extract the relevant findings.

​
Vendor profiles and assessments

Give me a full risk summary for Acme Corp, including any open findings and recent radar alerts.
The assistant calls query_vendors(kind="search") to resolve the name to an ID, then query_vendors(kind="detail") to pull the consolidated profile in a single call.
Summarize assessment cbqsrw_abc123 and list the controls that need human review.
The assistant calls query_assessments(kind="detail") and surfaces the control evaluations that are flagged or have open findings, so the reviewer can focus on what matters.
Give me the complete AI summary for the HubSpot assessment. I want the decision summary, the key business risks, the required conditions, and the vendor remediation message.
query_assessments(kind="detail") carries only the opening of the summary and says so. The assistant calls query_assessments(kind="summary") for the whole report, and pages through it if it runs long.
List every completed assessment this quarter with its outcome and residual risk level, as a table.
Both fields are on each query_assessments(kind="search") row, so this is one call per page rather than one call per assessment. See Replacing the assessment export if you are feeding a dashboard.
Which assessments did we conditionally approve last quarter, and what conditions did we attach to each?
The outcome is on the search rows, so the assistant filters there first, then reads the summary report for only the matching assessments to pull the conditions out of the narrative.
What does the assessment backlog look like? How many are in progress, and who owns each?
The assistant pulls get_report(report_name="review_queue") for the count of open / in-progress assessments and their owners, or get_report(report_name="assessment_metrics") for the rolling-window throughput view. (Assessment statuses are workflow stages such as collecting_documents, analyzing_questionnaire, and review_evals; there is no single in_progress status, so the review-queue report is the right tool for backlog.)

​
Evidence out of documents

Coverbase reads the documents and returns the passage the answer rests on. Full guide: Asking your documents a question.

Answer a control question from the SOC 2

Does Acme encrypt customer data at rest? Check their SOC 2.
The assistant resolves Acme, calls query_vendors(kind="document_evidence") scoped to that vendor, and gets a run id back rather than an answer. A model picks the one or two documents most likely to hold it, reads them, and locates the passage. A minute or two later the assistant calls query_vendors(kind="document_evidence_result", run_id=...) and reports the answer with its verbatim quote, the page, a cropped image of the highlighted passage, and a link that opens the document there.
What is the termination notice period in Acme’s MSA, and quote the clause.
Naming the document type narrows the candidate set before anything is read. The quote comes back verbatim, so it can go straight into a negotiation note.
In the Acme penetration test report, were any critical findings left unresolved?
Naming a document skips the selection step and reads that document.
I need evidence that Northwind does background checks on staff with production access. Find it and give me something I can cite.
The answer arrives with a page citation and a permanent Coverbase link. Paste the link into the assessment rather than the image: the image link expires after about an hour.
Does Acme have a documented incident response SLA?
If the documents read do not address it, the response says so rather than inferring an answer. Ask the assistant to widen the scope (drop the document type, raise the document limit) before concluding the control does not exist.

​
Vendor intelligence

Is this company real?

Is Acme Corp a real registered company? Show me the legal entity and where you got it from.
The assistant calls query_vendors(kind="company_registration"), which returns the validated corporate identity from GLEIF, OpenCorporates, and SEC EDGAR (official registered name, status, jurisdiction, and identifiers) with a link to each register’s record. If nothing matched confidently, it says so rather than offering the nearest guess.
What’s the security posture for Acme Corp, and what should I raise with them?
The assistant reads the vendor’s outside-in security posture: the rating and grade, the per-factor breakdown with the observed values behind it, the ranked next steps (most urgent first, each naming the evidence it rests on), and what changed since the previous scan. Ask it to draft the questions and it quotes the observed values, such as p=none or the CVE identifier, rather than paraphrasing them.
What’s the financial health score for Acme Corp, and has it moved in the last year?
The assistant calls query_vendors(kind="financial_health") and reports the score, risk band, confidence tier, pillar breakdown, and 3- and 12-month movement, along with the sources behind each figure and any that were unavailable.
Which of my tier-1 vendors are in the High or Very High financial risk bands?
The assistant resolves the vendor set, then pulls query_vendors(kind="financial_health") per vendor. Ask it to group by confidence tier: a Tier C score is inferred from signals and a Tier A score is computed from filed statements, so the two are not directly comparable and a ranking that mixes them is misleading.
Is the entity on the Acme contract the same one that’s registered and in good standing?
The assistant pulls query_vendors(kind="company_registration") for the registered legal name and status and compares it against the counterparty on the contract. A mismatch between the contracting entity and the registered entity is a real finding, not a formatting difference.

​
Program health and continuous monitoring

Weekly program standup

What is happening across our TPRM program this week? Show me recent assessments, open findings, and radar alerts.
The assistant calls get_report(report_name="org_activity", days=7) with reasonable limits. This is the single most useful prompt for a daily standup or weekly review.
Show me every vendor with overdue findings and their owners so I can chase them.
The assistant calls query_findings(kind="list_detailed") org-wide with a status filter for open and a date filter for past-due, then groups by assignee.
Are there any new radar alerts on our tier-1 vendors in the past 24 hours?
The assistant calls query_radar(kind="alerts") filtered by vendor ID for the tier-1 list, or asks get_report(report_name="org_activity", days=1).

​
Contracts and obligations

What contracts expire in the next 90 days, and which of those vendors have unresolved findings?
The assistant calls query_engagements_contracts(kind="contracts") with the date filter, then for each result calls query_findings(kind="search") scoped to that vendor.
Are there any obligations coming due next month that have not been assigned to anyone?
The assistant calls query_engagements_contracts(kind="obligations") filtered by due date and missing assignee.

​
Sourcing and RFPs

Draft an RFP from a sentence

Draft an RFP to replace our applicant tracking system for about 12 recruiters. It has to integrate with our HRIS and Microsoft 365, and we will not grant tenant-wide mailbox access.
The assistant calls mutate(entity="rfp", action="draft_brief"), which writes nothing and returns a proposed name, description, narrative and timeline for you to correct.
Who should we invite? Show me what each is known for and what to watch out for.
mutate(entity="rfp", action="research_vendors") returns five to ten candidates with the reasoning behind each. Still no write.
Suggest requirements and questions for it, then create the RFP with those and the four vendors I picked.
suggest_requirements and generate_questions propose the rubric and questionnaire; create, with confirm: true, builds the RFP, rubric, questionnaire, vendor records and invitations in one transaction, as a draft.
Run it silently and tell me how they stack up.
simulate_submissions researches how each invited vendor would most plausibly answer, then compare reads the whole set together. Every rendering states that these are researched estimates, not vendor responses. A vendor who already sent a real response is skipped.
What did Greenhouse say about mailbox scopes?
query_rfps(kind="submission_answers") returns that submission’s answers, each labelled with whether it came from the vendor or from research.

​
Bill of materials

Latest SBOM and its components

Show me the latest software bill of materials for vendor Acme and list its components.
The assistant calls query_vendors(kind="search") to resolve the name, then query_vendors(kind="bill_of_materials", vendor_id=...) to pull the current applied BOM and its components in one call.
Does Acme’s current SBOM include any GPL-licensed components?
Same bill_of_materials call, then the assistant filters the returned components by their licenses.
What AI models and datasets are in Acme’s AIBOM?
The assistant pulls the latest BOM and surfaces the machine-learning-model and data components.
Pull the components from Acme’s latest hardware BOM.
The assistant calls query_vendors(kind="bill_of_materials", vendor_id=...) and lists the hardware components.
List every bill of materials we’ve received from Acme over time. Which one is currently applied?
The assistant calls query_vendors(kind="bill_of_materials_history", vendor_id=...). The list comes back newest first; the first entry is the applied one.
Has Acme ever shipped a BOM that contained openssl? Show the history.
The assistant calls query_vendors(kind="bill_of_materials_history", vendor_id=...) and checks each BOM’s components for the match, tracing every hit back to its source document.
What these call: query_vendors(kind="bill_of_materials", vendor_id=...) or query_vendors(kind="bill_of_materials_history", vendor_id=...), both read-only and user/org-scoped. See the Bill of Materials API for the full argument list.

​
Write actions, with confirmation

Every write tool requires the assistant to propose the action in chat and wait for your explicit approval. The examples below show the pattern.
Add a note to vendor Acme Corp: following up with their security team next week.
The assistant proposes: “I am about to add a note to Acme Corp with the text ‘following up with their security team next week.’ Confirm?” After your approval, it calls mutate(entity="note", action="add", data={..., "confirm": true}).
Create a finding on assessment cbqsrw_abc123 titled “Missing encryption at rest evidence” and assign it to me.
The assistant proposes the finding (title, body, assessment ID, assignee), waits for confirmation, then calls mutate(entity="finding", action="create", data={..., "confirm": true}).
Update the risk tier of vendor Globex to Tier 1.
The assistant proposes the change to the vendor status, confirms, then calls mutate(entity="vendor", action="update", data={..., "confirm": true}) with the relevant status ID.
Log a radar event for Acme Corp: they disclosed a data breach today.
The assistant proposes the event (name, summary, impact type, vendor), waits for confirmation, then calls mutate(entity="radar_event", action="create", data={..., "confirm": true}).
That radar alert about Acme is a duplicate. Dismiss it and suppress similar ones.
The assistant proposes the dismissal (alert ID, reason, suppress_similar), confirms, then calls mutate(entity="radar_alert", action="dismiss", data={..., "confirm": true}).
Kick off a reassessment of Acme Corp because of that breach event.
The assistant lists reassessments via query_radar(kind="reassessments") to check for an existing one, then proposes a new reassessment (radar event, vendors, optional plan) and calls mutate(entity="reassessment", action="create", data={..., "confirm": true}). This never opens a case.

​
Tuning the AI

Find controls that flag too often

Which of our controls raise issues most often? I think some are misfiring.
The assistant calls get_report(report_name="control_flag_rates") to rank controls by issue-flag rate across recent assessments, with a volume floor so a control evaluated twice doesn’t top the list. Pass format='csv' if you want it in a spreadsheet.
Go through the flagged issues on assessment cbqsrw_abc123 with me and clear the ones that aren’t real.
The assistant walks each flagged evaluation with its evidence, and for the ones you clear calls mutate(entity="eval", action="update", data={..., "outcome": "not_an_issue", "confirm": true}).
That control keeps flagging vendors who do have MFA. Rewrite its guidance.
The assistant proposes new expectation, evaluation instruction, or evidence requirement text, confirms, then calls mutate(entity="control", action="update", data={..., "confirm": true}). Material edits create a new version rather than overwriting the old one. Re-run the analysis with mutate(entity="assessment", action="rerun", ...) to re-evaluate against the new guidance.

Canned prompts

Twenty scripted workflows you can invoke by name, including weekly_briefing, submit_intake_request, and tune_control_guidance.

Tool reference

Every route these prompts resolve to, and the parameters each accepts.

Replacing the assessment export

Every Consolidated Assessment Report column mapped to the call that returns it, with sample input and output.