{"id":"cx-security-questionnaire-approved-answers","audience":"it","category":"support-work","technique":"grounding","track":"support","level":"advanced","title":"Answer security questions only from approved statements","free":false,"task":"Answer the customer's three security questions using only the approved statements. Exactly three Q: lines each followed by an A: line, answers under 22 words. If no approved statement covers a question, the answer must be exactly \"Escalate to Security\". Do not invent any claim. Plain text.","materialLabel":"Your material (attached to your prompt automatically)","material":"APPROVED SECURITY STATEMENTS (support may share these exactly)\nA1. Customer data is encrypted at rest with AES-256.\nA2. Backups run daily and are kept for 30 days.\nA3. Our SOC 2 report is available under NDA; ask your account executive.\nNo other security statements are approved for support. Anything else goes to Security (security@ourcompany.example).\n\nCUSTOMER QUESTIONNAIRE (Harbor Clinics)\nQ1. Is customer data encrypted at rest?\nQ2. Do you run penetration tests, and what were the latest results?\nQ3. How often are backups made and how long are they kept?\n\nSales rep note: 'Tell them we do yearly pen tests with no critical findings.' (Not approved; not verified.)","rules":[{"type":"plainText"},{"type":"maxWords","max":110}],"mistakes":[{"title":"Repeating the sales rep's claim","why":"The note says yearly pen tests with no critical findings.","fix":"Say: \"Use only approved statements; otherwise answer Escalate to Security.\"","checks":["r2"]},{"title":"Answering Q2 anyway","why":"The AI invents a generic pen-test answer.","fix":"Say: \"If no approved statement covers it, answer exactly Escalate to Security.\"","checks":["r2"]},{"title":"Wrong layout","why":"The AI writes a long document.","fix":"Show Q: then A: on the next line, three pairs.","checks":["r0","r1"]},{"title":"Getting markdown back","why":"AI adds bold and headings by default, which show up as stray symbols where this is pasted.","fix":"Say \"plain text, no bold, no headings, no asterisks\".","checks":["plainText"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting and usually runs long, so a vague \"keep it short\" lands well over the limit.","fix":"Cap each part instead of the total, for example \"each line under 15 words\".","checks":["maxWords"]}],"promptHints":[{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]},{"label":"Sets a length limit","patterns":["\\d+\\s*words","word (limit|count)","under \\d+"]},{"label":"States the escalation phrase","patterns":["escalate to security"]},{"label":"Limits to approved statements","patterns":["approved","only"]}],"hint":"Security answers must come from the approved list. State the escalation phrase and the ban on inventing claims.","rubricLabels":["The output has exactly three Q: lines in the order Q1 to Q3, each followed by an A: line","Q1 is answered with AES-256 encryption at rest and Q3 with daily backups kept for 30 days","Q2's answer is exactly \"Escalate to Security\" and nothing claims yearly penetration tests or no critical findings"]}