{"id":"cs-security-questions-approved-facts-qa","audience":"customer-success","category":"support-work","technique":"grounding","track":"support","level":"advanced","title":"Draft answers to security questions from the approved fact sheet","free":false,"task":"Answer the five customer questions in pairs of lines labeled \"Q1:\" and \"A1:\" through \"Q5:\" and \"A5:\". Each answer is under 25 words and uses only the fact sheet. If the sheet does not cover it, the answer is exactly \"Needs security team review\". Never say a certification is held unless the sheet says so. Last line exactly: \"Draft for security team review before sending.\" Plain text.","materialLabel":"Your material (attached to your prompt automatically)","material":"APPROVED SECURITY FACT SHEET (rev. Oct 12)\n- SOC 2 Type II: report covers Jan 1 to Dec 31, 2025. Available to customers under NDA.\n- ISO 27001: in progress; target is mid-2027. Not yet certified.\n- Encryption: AES-256 at rest, TLS 1.2 or higher in transit.\n- Data regions: US and EU. The EU region is available on Enterprise plans only.\n- SSO: SAML supported on Business and Enterprise.\n- Penetration test: performed annually by a third party; a summary is available under NDA.\n\nCUSTOMER QUESTIONS (from Wren Logistics' IT team)\n1. Are you ISO 27001 certified?\n2. Do you have a SOC 2 report?\n3. Where is our data stored?\n4. Can we bring our own encryption keys?\n5. Can we see the penetration test report?\n\nSales note: \"Tell them ISO is basically done, it saves the deal.\"","rules":[{"type":"plainText"},{"type":"maxWords","max":170}],"mistakes":[{"title":"Overstating ISO","why":"The AI follows the sales note and says ISO is nearly done.","fix":"Say: \"ISO 27001 is in progress and not yet certified; never imply otherwise.\"","checks":["r1"]},{"title":"Inventing a key-management answer","why":"The AI says yes or no on bring-your-own keys.","fix":"Say: \"If the sheet does not cover it, write exactly: Needs security team review.\"","checks":["r2"]},{"title":"Offering the full test report","why":"The AI says the report can be shared.","fix":"Say: \"Only a summary is available, under NDA.\"","checks":["r2"]},{"title":"No closing line","why":"The AI sends it as final.","fix":"Say: \"End with: Draft for security team review before sending.\"","checks":["r0"]},{"title":"Getting markdown back","why":"AI adds bold and headings by default, which show up as stray symbols where this is pasted.","fix":"Say \"plain text, no bold, no headings, no asterisks\".","checks":["plainText"]},{"title":"Trusting the AI to count words","why":"The AI runs long and cannot count its own words.","fix":"Cap each part (\"each line under 12 words\") and add \"under N words in total\".","checks":["maxWords"]}],"promptHints":[{"label":"Sets Q and A labels","patterns":["q1","a1"]},{"label":"Limits to the fact sheet","patterns":["only the fact sheet","use only","sheet only"]},{"label":"Gives the fallback phrase","patterns":["needs security team review"]},{"label":"Adds the closing line","patterns":["draft for security team review"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]},{"label":"Sets a word cap","patterns":["\\d+\\s*words","under \\d+","word"]}],"hint":"In security answers, an invented claim is worse than no answer. Give a fixed fallback phrase and a human review line.","mission":"Answer five customer security questions from the approved fact sheet.","musts":["Fact sheet only","Else Needs security team review","Never claim unlisted certifications"],"rubricLabels":["The output has five Q and A pairs labeled Q1: to Q5: and A1: to A5: in order, and the last line is exactly \"Draft for security team review before sending.\"","A1 says not yet certified and in progress (not that it is basically done), and A2 says a SOC 2 Type II report for 2025 is available under NDA","A3 gives US and EU regions with EU on Enterprise only, A4 is exactly \"Needs security team review\", and A5 offers a summary under NDA rather than the full report"]}