What AI exists?
What can AI see?
What can AI decide?
What can AI do?
Who is accountable?
What evidence exists?
How is failure contained?

1. Pick the example closest to your AI use case.
2. Compare your use case against the example.
3. Identify what AI can see, decide, and do.
4. Assign the likely risk tier.
5. Identify required controls.
6. Identify missing evidence.
7. Decide whether the use case is ready, conditionally approved, or not ready.

examples/copilot-use-case-example.md

Enterprise copilots
Productivity assistants
AI-enabled workplace SaaS
Employee-facing AI assistants
Meeting, email, chat, or document copilots

User permission inheritance
Sensitive data guidance
Vendor processing
Prompt/input restrictions
Output review
Human accountability
Incident escalation

Tier 2, unless the copilot influences decisions or performs actions.

The copilot uses sensitive data.
The copilot generates official records.
The copilot influences decisions.
The copilot can call tools or trigger workflows.
The copilot is customer-facing.

examples/rag-assistant-example.md

Knowledge assistants
Policy assistants
Enterprise search AI
Document-grounded AI
RAG systems
Internal helpdesk assistants
Legal or compliance knowledge assistants

Data source mapping
Retrieval boundaries
Data owner approval
Source attribution
Prompt injection through retrieved content
Output grounding
Retrieval logging
Evidence reconstruction

Tier 2 or Tier 3, depending on whether the assistant influences decisions.

The RAG system retrieves sensitive data.
The system supports compliance, legal, HR, security, or financial decisions.
The system lacks source attribution.
The system can call tools or trigger workflows.

examples/agentic-ai-example.md

AI agents
Tool-using AI
Workflow automation
Ticket routing agents
IT operations agents
Multi-step task automation
AI systems that can request or perform actions

Agent identity
Autonomy level
Delegated authority
Tool inventory
Action classification
Approval gates
Blast-radius limits
Tool/action logs
Kill switch
Rollback or compensation
Incident containment

Tier 4, because the AI can use tools or affect workflow state.

The agent can perform privileged actions.
The agent can affect production systems.
The agent can make regulated or high-impact decisions.
The agent can perform financial, access, security, HR, legal, or customer-impacting actions.
The agent is difficult to stop or recover from.

examples/vendor-ai-example.md

AI-enabled SaaS
Embedded vendor AI
Vendor copilots
Customer support AI features
Third-party AI summaries
Vendor-provided recommendation features
Hosted model or platform AI

Vendor data processing
Prompt and output retention
Training and product improvement use
Subprocessors
Admin controls
Logging and evidence
Incident support
Feature disablement
Contractual terms

Tier 2 or Tier 3, depending on data and decision impact.

Vendor AI processes sensitive or regulated data.
Vendor AI influences customer, employee, financial, legal, security, or compliance decisions.
Vendor AI can perform actions inside the SaaS platform.
Vendor logs are unavailable.
Vendor retains or reuses enterprise data.

1. Read the closest example.
2. Complete the AI use case intake template.
3. Complete the risk assessment template.
4. Complete the control assessment template.
5. Use specialist templates if the use case involves sensitive data, vendor AI, decisions, tools, or agents.
6. Create an evidence package for high-risk AI.
7. Complete assurance testing before approval.

Classify the AI pattern
Assign ownership
Assign a risk tier
Identify data boundaries
Define decision boundaries
Control tools and actions
Assign human accountability
Define evidence
Plan assurance tests
Prepare incident containment
Make an approval decision