A low-risk AI project earns the label through its boundary, not its topic.

Decision under test: Can any candidate method perform the bounded task well enough on protected cases to justify a more realistic trial?

Entry condition

The target task, expected outputs, error categories, and evaluation cases can be defined before the candidate sees them, and no live workflow access is required.

Required evidence

A written task contract, protected representative cases, expected evidence, segment labels, simple non-AI baseline, scoring rules, prohibited outputs, evaluator instructions, and access and retention controls.

Exposure boundary

Run isolated candidates against fixed test material. Do not expose outputs to operational users, connect production tools, update records, contact anyone, or tune on the protected cases.

Retained authority

Domain owners define the expected result and material errors. Evaluation owners protect the holdout and decide whether the evidence is interpretable. No model output controls a business decision.

Measures

Results by case type and consequence, comparison with the baseline, abstention and refusal behavior, unsupported output rate, evaluator disagreement, run cost, latency, repeatability, and failed-case review.

Escalation risk

A convenient test set can exclude rare cases, encode one reviewer, leak into prompts or tuning, reward superficial similarity, or measure a proxy that has little connection to the real workflow.

Reversal plan

Revoke candidate access, retain the evaluation record, delete temporary material under the approved rule, and continue the current process unchanged. A failed benchmark creates no live migration to undo.

Decision under test: Would the candidate have supplied useful evidence on past work without changing the decisions that were actually made?

Entry condition

Past inputs, timestamps, decisions, corrections, and outcomes can be reconstructed lawfully, and the team can prevent future information from leaking into the replay.

Required evidence

Time-correct historical records, original decisions and reasons, later outcomes kept separate, versioned policies, known interventions, missing-data markers, permissions, and a replay protocol.

Exposure boundary

Recreate the information available at each historical point, run the candidate without writeback, compare it with the recorded process, and keep retrospective outcome data outside the candidate context.

Retained authority

Process owners determine whether the reconstruction is faithful, whether the original decision remains a valid comparator, and which discrepancies deserve investigation rather than automatic correction.

Measures

Coverage, error and abstention by time and segment, difference from the original process, corrected versus disputed records, reviewer effort, data gaps, stability across policy versions, and plausible effect on the target decision.

Escalation risk

Hindsight leakage, changed policy, incomplete records, survivor bias, model exposure to later outcomes, a historically weak comparator, or confident conclusions from a period unlike current work.

Reversal plan

Remove replay data and access as required, preserve the reproducible comparison, and leave current operations untouched. Any next step requires a new boundary and approval rather than inheriting replay permission.

Decision under test: Can the candidate handle current variation and timing while the existing workflow remains the only path that affects people or records?

Entry condition

Inputs can be copied safely, shadow processing cannot delay or alter live work, outcomes can be joined later, and the organization can afford the observation period and review burden.

Required evidence

Current permitted inputs, exact version identity, routing and timing data, baseline decisions, delayed outcome joins, failure injection cases, service limits, privacy rules, and an independent shutdown path.

Exposure boundary

Run beside the live process. Hide candidate outputs from decision-makers when comparison bias matters, block all write and communication paths, and record candidate results for later matched analysis.

Retained authority

Operational owners keep full control of the real decision and service. Technical owners can isolate or stop the shadow lane without touching production, and evaluators decide when comparison evidence is sufficient.

Measures

Match rate, disagreement, error by consequence and segment, abstention, latency, availability, input drift, operating cost, failure containment, and whether shadow results can be reconciled with final outcomes.

Escalation risk

A shadow connection can still expose data, consume scarce capacity, create a covert dependency, influence users through leaked output, or produce misleading results when the live decision changes the observed outcome.

Reversal plan

Disable the copied feed and compute, verify that no write path exists, remove shadow credentials, reconcile retained records, and confirm the original workflow was never dependent on the candidate.

Decision under test: Can a small group find and inspect permitted evidence more effectively without letting generated text become an authoritative answer?

Entry condition

The corpus is bounded and maintained, document and user permissions are enforceable, sources can be shown at passage level, and qualified users can judge support and completeness.

Required evidence

Approved source inventory, document versions, access rules, source owners, representative questions, expected citations, known gaps, forbidden topics, review rubric, and a reliable manual search path.

Exposure boundary

Retrieve candidate passages and compose a clearly non-authoritative response with citations. Permit no source changes, external communication, record updates, tool use, or action based solely on the response.

Retained authority

Users inspect the cited source and own any later interpretation or action. Source owners correct or withdraw material, and security and privacy owners control access and incident response.

Measures

Citation correctness and coverage, unsupported claims, missed evidence, permission isolation, useful abstention, user corrections, search and review time, over-reliance signals, and unresolved-question volume.

Escalation risk

Stale authority, retrieval misses, conflicting documents, hidden instructions in source material, permission leakage, a fluent answer replacing source inspection, or later reuse outside the tested context.

Reversal plan

Disable the interface and retrieval credentials, remove indexes and caches under the retention rule, preserve issue records, and return users to the maintained source library and manual search process.

Decision under test: Can a candidate prepare a useful internal draft while an accountable author retains every claim, recipient, commitment, and send decision?

Entry condition

The material is low consequence, required facts and tone rules are available, the final author has real review capacity, and technical controls can prevent autonomous sending or publication.

Required evidence

Permitted facts and sources, approved audience and purpose, required disclosures, prohibited claims, privacy rules, examples with usage rights, author rubric, review time, and a manual drafting baseline.

Exposure boundary

Create a visibly marked draft in an isolated workspace. Run deterministic checks, show sources and unresolved items, and require the author to move approved content through a separate communication path.

Retained authority

The author chooses the recipient, verifies facts, owns professional judgment and tone, rejects or rewrites content, and initiates any send or publish action outside the model-controlled environment.

Measures

Unsupported and prohibited claims, omissions, privacy findings, corrections, rejection rate, review time, author disagreement, copied phrasing, near-miss incidents, and whether the draft improved the whole task rather than typing speed alone.

Escalation risk

Review fatigue, fabricated support, sensitive context in prompts, inappropriate reuse, concealed automation, wrong audience, accidental send paths, or fluency that turns approval into a ritual.

Reversal plan

Remove generation access and integrations, retain approved records only as policy requires, restore the manual template, and verify that no scheduled job, token, webhook, or user habit depends on the workbench.

Decision under test: Can a bounded suggestion improve a reversible review step for a small population without hiding missed cases or granting entitlement, priority, or final disposition?

Entry condition

The queue has stable owners, a correctable intermediate decision, measurable outcomes, deliberate control or holdout cases, capacity to review both suggestions and misses, and a safe manual route.

Required evidence

Current taxonomy, approved population, sampling rule, baseline queue data, rare and protected cases, human review standard, override reasons, outcome definition, capacity limits, and an immediate disable path.

Exposure boundary

Offer one suggestion inside a capped queue, apply policy and permission rules deterministically, require reviewer disposition, preserve a control sample, inspect non-suggested cases, and prevent downstream action without approval.

Retained authority

Queue owners define categories and service rules. Reviewers decide the case. Accountable leaders set exposure, approve changes, respond to unfair or harmful patterns, and can return all work to the manual path.

Measures

Outcome and handling time against the baseline, errors by class and consequence, missed cases from sampling, override patterns, queue balance, reviewer load, affected-group differences, incidents, and downstream reconciliation.

Escalation risk

The suggestion can anchor reviewers, shift service quality, hide false negatives, amplify historical practice, overload one queue, expand beyond the approved population, or become a de facto decision despite formal review.

Reversal plan

Set exposure to zero, route all items through the manual rule, remove model access, reconcile pending and completed cases, notify queue owners, and review whether any policy or staffing decision had begun to rely on the suggestion.