Researches vendor security and privacy documentation to answer the German Works Council's 14-question software-tool form — half of it automatically, so the review teams stop doing the requester's homework.
Contentful spent eight months negotiating an IT Framework Agreement (ITFA) with its German Works Council. The agreement requires a 14-question form for every new software tool procurement — spanning legal, IT, and People domains: data processing, security controls, employee personal data, monitoring, deletion periods.
The bottleneck: requesters submitted incomplete, superficial, or inaccurate responses. The Legal, IT, and People teams spent their time chasing corrections or redoing the research themselves. The root cause wasn't laziness — the information exists publicly in vendor DPAs, trust centers, and security documentation, but requesters don't know where to look or what's being asked.
A Glean agent operated by the review team, not the requester. Given a vendor domain and tool name, it locates the DPA, trust center, sub-processor list, and privacy policy, then produces a pre-populated Schedule 1 form with each answer backed by a source link and a confidence level.
The coverage map is where the real design work happened — deciding which of the 14 questions the agent can honestly answer, which need a human, and which sit in between:
| Coverage | Count | Questions |
|---|---|---|
| Agent | 5 | 5.3 safeguards · 5.5 personal-data categories · 5.6 location monitoring · 5.11 storage location · 5.13 deletion periods |
| Partial | 3 | 5.7 performance mgmt · 5.8 reporting · 5.12 DPA/TIA status |
| Human | 6 | 5.1 description · 5.2 risk assessment · 5.4 purpose · 5.9 roles · 5.10 timeline · 5.14 training |
The honest line mattered. The agent doesn't pretend to answer everything. It answers the five it can source, flags the three it partially can, and hands the other six back to the people who actually know.
Seven iterations over eight weeks, each one correcting a real failure found in testing — not speculative polish.
V1 → v3: PRD, then Tyler's build, then Charlie's 6-step workflow with a golden example (Cursor) and targeted search areas.
v4: The pivot — the process is Google Doc-based, not Jira-based. Output became a pre-populated Schedule 1 document, not a ticket comment.
v5: Eval-driven fixes against Lisa's real test cases (Trellus, Vitally, Qualibooth) — quote attribution, source hierarchy, confidence-rating leak.
v6 → v7.2: DPA as required input, then the source-priority bug fix, then DPA file upload as a third input path.
Improvement: Review teams stopped being researchers and got back to validating. Every agent-produced answer ships with a source link and a confidence level, so the reviewer verifies instead of searches. The bar was explicit from the start: better than what the requester typically provides — not perfect.
ROI: Roughly an hour of vendor research recovered per request, at a ~$250/hr loaded attorney cost — ~$250 per ticket, scaled across the review team's volume.