Limited published evidence · Security review and sales operations
AI security questionnaire: Box example
Aaron Levie shared a post on X from Box describing a demonstration in which an agent answers twelve security questions against three approved policy documents, using Box Mount and an Excel workbook. Ten answers were reported as supported and two were routed for human review. This is a vendor demo description, not customer evidence.
Answer a security questionnaire from approved policies and route unsupported claims for review
Box product demonstration
Product demonstration described in a Box post and shared by Aaron Levie. Customer adoption, video execution and resulting artifacts were not independently verified.
A published third-party example, not a Nuvepro customer case or evidence of a partnership.
The workflow at a glance
Policy-supported questionnaire answers and review items
Illustrative summary of the published account
- Demo inputs
Questions and approved policy documents
The vendor post describes twelve security questions checked against three approved policy documents.
- NextEvidence handling
Ten supported answers; two for human review
The two questions lack document support for the claims. This is the reported demo split, not a general accuracy rate.
- NextDemo artifact
Evidence-linked Excel workbook
The post describes an evidence-linked Excel workbook and a review list synced to Box; actual files were not inspected.
What the source reports
Box describes an agent working through twelve security questions against three approved policy documents. The post reports ten supported answers and two questions routed for human review because the documents do not support the claims. The described output is an Excel workbook with evidence and a review list synced to Box. Aaron Levie's accompanying commentary concerns agents working with governed files. These are a vendor demo description and related commentary, not independent evidence of customer production performance.
Reported technology: Box Mount and an AI agent described in Box's X demonstration. Scope and outcomes are source-reported.
What the enterprise environment would need
The following is a proposed project design for an enterprise doing similar work. Published details are marked; the remaining systems, data and scenarios would be agreed for your project.
Proposed practice environment
Answer a questionnaire without inventing assurances
Illustrative project design to scope with your enterprise.
Checks designed, not executed. Domain owners must agree the reference results, permissions and acceptance tests before implementation.
- 1 · Set up the environment
Versioned fictional policies and workbook
Use an approved test folder, question cells, citations and a review queue.
- 2 · Agent prepares; security reviewer resolves gaps
Agent drafts sourced answers
Draft supported answers with citations; the security reviewer resolves missing or conflicting policy evidence before an answer can be accepted.
- 3 · Independent checks
Independent policy and saved-artifact checks
Inspect actual cells, source references and synced review state; verify document and folder scope.
- 4 · People decide acceptance
Security owner accepts the response evidence
Review the exact checked workbook and held questions. Any external-use authorization is a separate decision outside this practice.
A reviewable evidence package
A checked workbook with citations and a visible unsupported-claim queue.
If a check fails → withhold acceptance.
Remove the policy supporting encryption. Mark that answer unresolved instead of retaining the old assurance.
Failure or owner rejection returns to review
- Hold
- → 2 · Revise answers and the review queue
- → 3 · Rerun independent checks
- → 4 · Owner review
Operating boundary. No invented security commitment or external sharing without owner approval.
- Systems and tools
- Source-described: Box Mount, a Box folder, policy documents and an Excel workbook. Proposed: use an approved test folder and agent/file tools with observable reads and writes.
- Data and state
- Source-described: twelve questionnaire items and three approved policies. Proposed: provide versioned fictional policies, answer cells, citations and an unresolved-review queue.
- People and handoffs
- Source-described: unsupported claims are routed for human review. Proposed: a security owner checks source support, resolves questions and approves any customer-facing response.
- Rules and authority
- Proposed: allow answers only from approved policy versions, retain evidence links and restrict writes to the intended workbook/folder. An agent must not invent a security commitment.
- Normal and exception cases
- Source-described: two answers require review because policy support is missing. Proposed: add an expired policy, contradictory wording and an inaccessible document to test abstention.
- Reset and replay
- Proposed: restore policy versions and the unanswered workbook; replay after changing one policy and verify that affected answers and review items are updated together.
A proposed simulation
An illustrative practice design derived from this work, not an executed assessment.
Proposed: complete a fictional security questionnaire with sourced answers and a visible queue of unsupported claims for the security reviewer.
Review gate: Proposed: the security owner validates policy support, artifact contents, unresolved questions and access controls before approving external use.
Challenge the result: Proposed: remove the policy supporting an encryption claim. The answer must become unresolved rather than retain or fabricate the earlier assurance.
What needs checking
- Proposed: independently check that each answer is supported by the cited approved policy and that unsupported claims remain unresolved.
- Proposed: inspect actual workbook cells, evidence references and review-list state after sync; a successful tool response is insufficient.
- Proposed: verify folder permissions, document versions and human approval before the questionnaire is shared externally.
Review environment fidelity, human capability and agent performance separately. The enterprise’s accountable owners decide acceptance of the shared workflow and any operating use.
Questions about this example
- What does the Box agent do in the questionnaire demo?
- In a post on X, Box describes an agent working through twelve security questions against three approved policy documents, as shared by Aaron Levie. The described output is an Excel workbook with evidence and a review list synced to Box. Ten answers were reported as supported.
- Who reviews answers the Box agent cannot support?
- In the demo Box describes, two questions were routed for human review because the approved documents did not support the claims. Box's post does not describe wider review. A proposed check, not part of the demo, is that a security owner approves any customer-facing response.
- How strong is the evidence for the Box demo?
- Weak. It is an early-stage vendor demonstration described in a Box post on X and shared by Aaron Levie. Customer adoption, video execution and resulting artifacts were not independently verified. The twelve-question split is not a general accuracy rate or an independent evaluation.
- What would an enterprise need to build something similar?
- This is Nuvepro's proposed design for discussion, not executed work or Box's setup. It would use an approved test folder, versioned fictional policies, answer cells with citations, an unresolved-review queue and restricted writes, tested with an expired policy and contradictory wording.
Shape this around your enterprise
Bring a similar workflow and the people responsible for it. Together, define the records and systems to use, the result your team will build or configure, and how its owners will check it. Nuvepro scopes the simulation, environment and preparation. Agree any existing-agent evaluation, implementation assistance and production responsibilities separately.
Sources and limitations
Curation review: . This is the date this source example was reviewed, separate from source publication dates.
- Only the original post's demo description and Aaron's commentary were read. The video was not fully reviewed or reproduced, and the underlying policies and workbook were not inspected.
- The twelve-question split describes that demo, not a general accuracy rate, independent evaluation or named customer deployment.
- The proposed environment, practice project and checks are designs for discussion, not executed Nuvepro work or evidence of production readiness.
- Security questionnaire with approved policies, workbook and review listSource publication: 2026-10-08
- Box Mount for agents working with governed filesSource publication: 2026-10-09
More sales and marketing examples
- AI ad campaign management: Advolve exampleAdvolve
- AI launch readiness checks: RingCentral exampleRingCentral
- AI lead follow-up dashboard: Zapier exampleZapier
- AI RFP contract agent experiments: Box exampleBox internal experiments