# Supplier answer and evidence exercise

Compare a fictional source clause, its scoped answer and a separate restricted-evidence decision.

Entirely fictional supplier and policy. No real control approval, audit or certification is represented.

Source: https://aona.ai/resources/guides/security-questionnaires-ai-input-controls/
Sources checked: 2026-09-21

| Record | Populated example | Limit |
| --- | --- | --- |
| Question | Who reviews demo portal access? | Fictional questionnaire |
| Answer | The demo owner reviews access requests | Policy statement only |
| Source | demo-policy.txt, access clause | Synthetic source |
| Restricted evidence | Separate internal marker | Withheld in the exercise |

## Review checklist

- [ ] Link each answer to a current source
  Record revision, owner and the limitation the source actually establishes.
- [ ] Review evidence audience separately
  Permission to provide an answer does not automatically permit uploading its evidence files.
- [ ] Check the draft against the source
  Do not turn a policy statement into an unsupported effectiveness or certification claim.

## Included example files

- README.md
- demo-policy.txt
- answer-library.csv
- prepared-answer.md
- restricted-evidence-canary.txt
- review-record.md

## Source references

- OAIC: Use of commercially available AI products: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.