{
  "manifestVersion": 1,
  "process": {
    "slug": "vendor-security-review",
    "title": "Vendor security review",
    "phase": "compliance",
    "description": "Create a vendor security assessment workflow for SOC 2 compliance — questionnaires, risk scoring, and approval."
  },
  "manifestUrl": "https://ultrametric.ai/productarena/processes/vendor-security-review/manifest.json",
  "steps": [
    {
      "id": "n1",
      "title": "Create vendor assessment template",
      "kind": "api",
      "route": "agent",
      "toolCall": null,
      "calls": [
        {
          "method": "POST /v1/databases",
          "type": "rest",
          "description": "Create vendor assessment DB"
        }
      ],
      "vendorOptions": [
        {
          "vendor": "notion",
          "name": "Notion",
          "productId": "notion",
          "arena": "project-management",
          "agentReady": 58.6,
          "mcpEndpoint": null,
          "paProductUrl": "https://ultrametric.ai/productarena/arena/project-management/product/notion"
        }
      ],
      "approvalRequired": true,
      "riskLevel": null,
      "estimatedMinutes": 30,
      "async": false
    },
    {
      "id": "n2",
      "title": "Send security questionnaires",
      "kind": "api",
      "route": "agent",
      "toolCall": null,
      "calls": [
        {
          "method": "gmail.users.messages.send",
          "type": "rest",
          "description": "Send questionnaires"
        }
      ],
      "vendorOptions": [
        {
          "vendor": "gmail",
          "name": "Gmail",
          "productId": null,
          "arena": null,
          "agentReady": null,
          "mcpEndpoint": null,
          "paProductUrl": null
        }
      ],
      "approvalRequired": true,
      "riskLevel": null,
      "estimatedMinutes": 15,
      "async": false
    },
    {
      "id": "n3",
      "title": "Vendors respond",
      "kind": "human",
      "route": "person",
      "toolCall": null,
      "calls": [],
      "vendorOptions": [],
      "approvalRequired": false,
      "riskLevel": null,
      "estimatedMinutes": 7200,
      "async": true
    },
    {
      "id": "n4",
      "title": "Score and assess responses",
      "kind": "human",
      "route": "person",
      "toolCall": null,
      "calls": [],
      "vendorOptions": [],
      "approvalRequired": true,
      "riskLevel": "high",
      "estimatedMinutes": 120,
      "async": false
    },
    {
      "id": "n5",
      "title": "Log in Vanta",
      "kind": "api",
      "route": "agent",
      "toolCall": null,
      "calls": [
        {
          "method": "POST /v1/vendors",
          "type": "rest",
          "description": "Add vendor to Vanta"
        }
      ],
      "vendorOptions": [
        {
          "vendor": "vanta",
          "name": "Vanta",
          "productId": null,
          "arena": null,
          "agentReady": null,
          "mcpEndpoint": null,
          "paProductUrl": null
        }
      ],
      "approvalRequired": true,
      "riskLevel": null,
      "estimatedMinutes": 10,
      "async": false
    }
  ],
  "provenance": {
    "source": "productarena",
    "url": "https://ultrametric.ai/productarena",
    "generatedFrom": "data/processes.json + data/process-chains.json (the ProductArena founder-process corpus), resolved against live arena leaderboards at build time. Regenerate by refetching this manifest URL — it always reflects the currently deployed data, not a pinned data commit.",
    "license": "ProductArena Data License (DATA-LICENSE in github.com/ultrametricai/productarena): querying and quoting with attribution to \"ProductArena by Ultrametric Inc\" is fine; bulk redistribution or use to build competing datasets requires written permission."
  }
}