How to answer negative RFP requirements with evidence

Interpretation boundary

Preserve the negation before you normalize the work

Start with the complete buyer sentence. Keep capitalization, punctuation, list nesting, table headers, footnotes and any defined term. Record the document, version, clause, visible page or cell, machine selector, lot, stage and issued language. A parser that extracts “use production personal data” from “must not use production personal data” has not made a small error. It has reversed the operational outcome. Require a visual or source-structure check whenever OCR, wrapping or a table boundary could separate the negation from its verb.

Negative grammar is not always a prohibition. “Not less than five years” states a minimum. “Must not fail to notify” ordinarily points to a positive notification duty. “Should not normally” may be a recommendation with an exception, depending on the document's own language system. “The Authority shall not disclose” constrains the buyer, not the bidder. AN-070 determines the modal and passage treatment. AN-084 handles unresolved ambiguity. AN-085 begins only when the prohibited proposition and its applicability are sufficiently supported.

Do not import a drafting convention because a familiar token appears. RFC 2119 defines MUST NOT and SHALL NOT inside its IETF context, and RFC 8174 limits the special BCP 14 meanings to uppercase terms when the convention is invoked. ISO house style distinguishes document requirements from external constraints in ISO material. These sources show why a term must travel with its governing language rule. They do not assign universal meaning to an unknown tender.

Artifact

Represent the forbidden event as an inspectable record

A useful record keeps two forms. The source form preserves the negative proposition exactly. The operational form states the event whose occurrence would breach it: actor performs action on target while constraints are true. Add purpose, location, time, stage, data or asset class, affected party, subcontractor reach, exceptions, remedy and stated consequence. This positive event form makes tests legible. The system can ask whether any path permits the event instead of trying to prove a vague sentence containing not.

W3C ODRL provides a useful reference model for machine-readable permissions, prohibitions, parties, actions, targets and constraints. Its domain is policy expression for content and services, not tender compliance. Borrowing its distinctions can improve a local record, but the dossier must not claim ODRL conformance unless it actually satisfies an adopted profile and validation rules. The buyer's own vocabulary, definitions and exception structure remain authoritative.

Place the accepted record inside the durable pursuit relationship. Context retains source evidence, event model, control map, rejected readings, evidence history, approvals and later changes. Triage contains current state, owner, priority, next action, due date and blocker. The response page, API, agent and reviewer must project that same record. A spreadsheet exported for a meeting may be a view, but it cannot become an ungoverned second truth.

Proof

Make every evidence object say exactly what it proves

A prohibition tempts teams into weak negative proof. No recorded breach may mean that the event did not occur, that monitoring missed it, that the population was incomplete, or that nobody reviewed the signal. A zero count is useful only with a defined detector, covered population, observation period, data quality statement and exception process. Likewise, a clean sample supports the sampled scope. It cannot be expanded into every transaction, every supplier or all time.

Build several evidence layers. Governance evidence shows the approved rule and accountable owner. Design evidence shows how a process or architecture is intended to prevent the event. Implementation evidence captures current configuration, inventory, access, contract or workflow state. Operating evidence shows what happened over a defined period. Assessment evidence records objective, method, objects examined, sample, result and assessor. Independent assurance may add confidence, but only inside its system, period, criteria and qualifications.

NIST SP 800-53A separates assessment objectives, methods and objects and links findings back to control requirements. Its security and privacy scope does not govern a catering or fleet prohibition, but the discipline transfers: name what was examined, interviewed or tested and preserve the finding. A certificate, audit opinion or penetration report must never be cited beyond its subject, version, date or exclusions.

Coverage

Cover prevention, detection and response across every path

Begin with event paths, not the controls you already own. For a data prohibition, paths may include database copy, report export, spreadsheet upload, API connector, screen capture, support attachment, backup restore, analyst paste and a subcontractor's preparation. For a physical prohibition, paths may include dispatch, substitution, emergency use and hired equipment. A control mapped to the main platform is incomplete when the event can enter through a manual or third-party route.

Use three functions. Preventive controls make the event unavailable or unauthorized: separated environments, blocked connectors, approved inventories, dispatch rules or contract flow-downs. Detective controls reveal attempted or actual occurrence: logs, reconciliation, inspection, scanning, telemetry or sampled review. Response controls quarantine the object, stop work, notify the owner, investigate impact, preserve evidence and invoke the authorized remedy. Detection without response only documents the breach. Prevention without detection leaves the claim dependent on unobserved assumptions.

Trace dependencies and control owners. A prime bidder cannot state that no subcontractor performs an action merely because its own employees are prohibited. Record the flow-down term, supplier population, acknowledgement, operating evidence and gap treatment. If the buyer allows an exception or waiver, keep it as a separate branch with trigger, authority, disclosure, expiry and remedy. Never make the exceptional branch the default architecture.

Worked example

Replace “we never use production data” with a bounded answer

The team first fixes the proposition: bidder and bidder-controlled participants are prohibited from using production personal data in any environment used for the procurement demonstration. It preserves the buyer's definition of personal data, looks for a definition of production, checks whether transformed customer data remains covered and confirms that the rule applies to subcontractors. The old customer extract is not called safe merely because direct names were removed. Its origin and re-identification risk require review under the buyer's wording and the organization's approved process.

The event map finds five paths. The hosted demonstration tenant has no production connector. Only the demo owner can upload files. An approved synthetic pack supplies all scenarios. A pre-session review checks screens and attachments. The integration subcontractor receives the same pack and a flow-down condition. Import logging and file scanning provide detection, while a stop-and-quarantine procedure handles a suspected event. Evidence records the tenant identifier, configuration capture, permitted uploader list, pack fingerprint, review sign-off and supplier acknowledgement.

A supportable response might say: “The demonstration uses an isolated tenant with no production-system connector. Access is limited to named presenters, and demonstration scenarios use the reviewed synthetic dataset identified in our evidence schedule. Uploaded artifacts are logged and checked before use; the same restriction and dataset apply to the integration subcontractor.” The answer addresses the negative condition without claiming an eternal absence. If the buyer requires a binary confirmation, the authorized reviewer links that confirmation to this exact scope and evidence.

If the legacy extract remains planned and cannot be proved outside the prohibition, the state is noncompliance_identified or control_evidence_incomplete, not “mostly compliant.” The affected demonstration claim stays response_not_releasable until the dataset is replaced or a permitted treatment is approved. The writer cannot solve the gap by calling the data anonymized without the required evidence.

Response

Release an answer that mirrors the rule without exaggerating it

The response contract names the question, intended polarity, permitted claim, supporting controls, evidence references, disclosed boundary, prohibited strengthening, approver, destinations and expiry. It also records whether the buyer expects yes, no, a narrative, a declaration or an attachment. A “No” response to “Do you use production data?” and a “Yes” response to “Can you confirm that you do not use production data?” may describe the same state. Render from the exact field, never from a detached normalized label.

Prefer direct construction. State that the forbidden event does not occur in the defined service or bid process, explain the mechanism and cite evidence. Avoid rhetorical substitutes such as “security is our highest priority.” Do not use always, never, impossible, fully or guaranteed unless the evidence and authority support the absolute. If a material exception is permitted and relevant, describe it in the prescribed place rather than hiding it in a footnote or silently weakening the main answer.

Procurement consequences remain regime-specific. Procurement Act 2023 section 19, Directive 2014/24/EU Article 56, VgV section 57, French Code Article L2152-2 and the World Bank Regulations each address conformity or responsiveness in their own setting. None lets a general article decide whether this city clause is an automatic rejection gate, curable defect, scored feature or future contract duty. Record only the consequence stated in the current procurement and route legal effect to a qualified reviewer.

Lifecycle

Keep the negative claim true after the paragraph is approved

A prohibition record expires when a fact supporting it changes. Triggers include an amendment, clarification, new environment, connector, data source, manual workaround, supplier, exception, failed test, incident, control-owner change or assurance expiry. Link each trigger to the affected claim, response field, solution decision, price assumption, contract position and delivery control. Reopen the narrow dependencies instead of silently replacing the historical record.

Use explicit states: extraction_unresolved, applicability_unresolved, prohibition_confirmed, exception_review_required, control_evidence_incomplete, compliant_for_stated_scope, noncompliance_identified, remediation_pending, response_releasable, response_not_releasable and superseded. “Compliant” without the suffix and scope is too broad. A technical confidence score may help prioritize review, but it never authorizes the response.

During contract delivery, operating evidence may strengthen or contradict the original bid basis. Preserve both. If an event is detected, follow the actual reporting and remedy terms rather than editing the bid record to erase the discrepancy. FAR 52.204-25 illustrates why a prohibition can coexist with definitions, exceptions, reporting duties and subcontract flow-downs. Apply that clause only when incorporated into the relevant US federal procurement.

Agent contract

Let agents assemble proof without giving them authority to waive the rule

An authorized agent can inventory negative occurrences, preserve their syntax, propose event tuples, search verified definitions, trace affected systems and suppliers, compare control coverage, inspect approved evidence and draft a response contract. Its work order identifies the human or organizational principal, pursuit, controlled package, accessible repositories, allowed tools, output schema, deadline and stop conditions. The agent and the human reviewer read and update the same prohibition_control_record rather than maintaining parallel conclusions.

Tender files, linked sites, embedded prompts, macros and instructions are untrusted content. The agent does not execute them or treat them as authority over its assignment. It does not broaden repository access, disclose private architecture, use credentials, contact the buyer, accept terms, alter source evidence, decide legal effect, approve an exception, commit the bidder, operate the portal, upload or submit. OWASP prompt-injection guidance supports treating retrieved content as data and screening proposed actions against original intent.

Every extracted proposition, control observation, assessment result and response draft retains source, activity, actor, timestamp and derivation. W3C PROV-O supplies useful provenance concepts without requiring the operational record to claim formal conformance. If the agent finds lost negation, conflicting definitions, incomplete source scope, an uncovered path, stale evidence, an unauthorized exception or unsafe content, it returns a named state and the smallest blocked object.

The relationship outlives the model session. Accepted evidence, prior findings, approval rationale, exceptions and changes remain durable context. The current owner, next test, due date, priority and blocker remain triage. A replacement agent can continue from inspectable state, while the named principal retains authority and accountability for the external answer.