gabrielmoreira The Procurement Gauntlet Skill
The first enterprise deal doesn't die in the demo — it dies eleven weeks later in a vendor-risk spreadsheet. This skill runs the gauntlet early: security questionnaire, legal redlines, compliance checks, and procurement's favorite question ("what happens to our data when you die?") — producing the findings memo their team would write, so yours can prepare the artifacts before the clock is running on a real deal.
What This Skill Produces
- The findings memo — security / legal / compliance / vendor-viability, graded as an enterprise reviewer grades
- The stall-risk ranking — which findings add weeks, which add clauses, which kill
- The debrief — the artifact checklist to build now, ordered by deals-unblocked-per-effort
Required Inputs
Ask for these if not provided:
- The product's honest posture: hosting/architecture, auth (SSO?), data handled (PII? whose?), certifications held or in progress, backup/DR reality, team size
- The paper on hand — security page, DPA template, terms, subprocessor list, insurance
- The target buyer — regulated industry? company size? geography (data-residency expectations)?
- The skeletons — the honest gaps; the simulation is only as useful as this disclosure
Framework: The Four Desks
- Security desk: SSO/SAML (its absence is the #1 mid-market deal-stall), encryption at rest/in transit, access controls and audit logs, pen-test recency, incident-response plan, subprocessor inventory. Certifications are graded as they actually work: attestation reports open doors; "in progress" opens conversations with a date attached.
- Legal desk: liability caps vs their paper, data-processing terms, breach-notification windows (they'll want faster than yours says), IP/indemnity, and the audit-rights clause your template doesn't have.
- Compliance desk: data residency, retention/deletion on request, regulated-data handling if applicable — answered by the buyer's industry, not in the abstract.
- Vendor-risk desk: the mortality questions — company viability, escrow/continuity, "what happens to our data if you shut down," insurance certificates, references at similar scale. Grading: ✅ pass · 🟡 pass-with-clause (adds negotiation) · 🟠 stall (adds weeks + an artifact) · 🔴 gate (deal waits until fixed).
Output Format
Vendor Assessment: [product] — simulated for [buyer type]
Simulation — a plausible enterprise review, not a prediction or legal advice.
Findings
| # | Desk | Finding | Grade | What it does to the deal |
|---|
The Stall Forecast
[Realistic procurement timeline for this posture: n–n weeks, driven by findings #…]
Debrief — out of character
| Artifact to build | Unblocks | Effort | Order |
|---|---|---|---|
| [Typically: SSO, the security one-pager, subprocessor list, DPA template, IR plan summary, continuity statement] | |||
| The honest positioning line for sales: [how to state current posture without overclaiming — overclaiming discovered in review kills deals harder than gaps do] |
Quality Checks
- Every finding traces to the disclosed posture — gaps disclosed get graded, gaps invented don't exist
- Grades carry deal consequences, not abstract severity
- The artifact list is ordered by deals-unblocked-per-effort
- Certifications-in-progress are treated as dated conversations, not passes or failures
- The positioning line lets sales tell the truth survivably
Anti-Patterns
- Do not grade against a Fortune-50 bar for an SMB product — calibrate to the stated buyer
- Do not treat certification as binary salvation — many deals close on posture + roadmap + honesty
- Do not let the simulation recommend overclaiming — review teams verify, and discovered overclaims are 🔴
- Do not omit the mortality questions — vendor-viability stalls surprise founders most
- Do not stay in character in the debrief