Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Autonomous Intake removes the manual routing layer between procurement and risk teams. A requester says what they want; Coverbase identifies the vendor, checks whether you already pay for something that does the job, screens the company, drafts the inherent risk questionnaire, and puts a complete request in front of a reviewer. Every engagement enters the TPRM program at the correct depth, and the requester spends minutes rather than an afternoon.

​
What it does

Free-form submission parsing

Accept submissions in their natural form (requester context, vendor identity, intended use, data types) without forcing a rigid form structure.

Vendor identity research

Identify the company from a name: what it does, its website, its headquarters, its trust center. The requester confirms the match before anything else runs, so a request is never filed against the wrong Acme.

Redundancy detection

Rank your existing vendors against the request and surface prior relationships, so a second tool for a job an approved vendor already covers gets caught before the spend, not during review.

Pre-qualification screening

Screen financial stability, security posture, and sanctions exposure as part of the flow. Screening can be turned off per intake portal, and a vendor that doesn’t clear is surfaced to a human rather than auto-rejected.

Questionnaire autofill

Answer the inherent risk questionnaire from public sources and the context supplied, with per-answer confidence and the reasoning behind each. The requester validates rather than types.

Risk classification

Score each request’s inherent risk from the questionnaire answers (data sensitivity, criticality, engagement type) and band it on your risk scale, overall and per risk domain. Drives which controls apply.

Control set selection

When a reviewer approves the request and launches an assessment, the assessment plan’s rules pick the control sets from the inherent risk score, the per-domain scores, and tags, including any custom control sets layered on your baseline standard.

Workflow sequencing

Trigger workflow automations when a request is submitted or approved, so the assessment, the contract, and downstream tickets follow without a manual hand-off.

​
Three ways in, one process

A request can arrive three ways. All three produce the same intake session, obey the same configuration, and land in the same reviewer queue.

The portal

A requester fills in the browser form: select vendor, add information, review questionnaires.

The API

POST a free-form payload from procurement or ticketing and poll for the generated answers.

Chat

An AI assistant runs the whole request conversationally through the MCP server.

​
You decide which steps run

Intake is configuration, not a fixed script. Your intake portal decides which steps exist, and every surface honours it, including chat, which will not reintroduce a step you deliberately turned off.

​
Submitting is not approval

A completed intake request is a request, not permission. A vendor record created through intake sits in Created status; it is not an approved vendor until a reviewer decides the request.
This is the point of the product. The requester gets a fast, guided path and a clear answer about what happens next; the risk team keeps the decision.

​
Common workflows

Conversational intake

A requester asks an AI assistant for the tool they want (“I want to start using Northwind Analytics”), and the assistant runs the request: confirms the vendor’s identity against research, surfaces existing vendors that already cover the need, runs the screening the portal configures, and walks the inherent risk questionnaire one question at a time. No form, and no requester who has to learn the word “intake”. See Vendor intake in chat.
Call the Intake API from your procurement or ticketing system. When a requester opens a new vendor request there, the request’s free-form context becomes an intake session, and Intake researches the vendor and drafts the questionnaire before a reviewer sees it.
Use the classification to drive approval routing. Tier 1 vendors loop in CISO and Legal; Tier 4 SaaS tools follow a lightweight path. The same intake form, different downstream depth.
Let requesters submit through a simple form. Intake handles classification, reviewer assignment, and follow-up questions to the requester so risk teams aren’t the bottleneck.
Requests arrive pre-enriched with the screening results, the duplicate readout, and the auto-answered questionnaire. Reviewers validate rather than research, and can approve, reject, or send a request back with a specific question. This works in the dashboard or in chat.

​
Guides

Requesting a new vendor

For the business requester: what you’ll be asked, how to file it, and what happens after you submit.

Analyst and reviewer guide

For the risk team: triaging the queue, reading the enrichment, and validating auto-answered questions.
Autonomous Intake is configured in the dashboard and exposed programmatically through the platform API. See the Intake API reference for creating intake requests with free-form context. Talk to your account manager about API access if it’s not yet enabled on your plan.