OutcomeWhat must improve, and for whom?
Failure to prevent
A convincing demonstration replaces a useful result.
Evidence to keep
Baseline, acceptance criteria, and prohibited outcomes.
Use AI only when it improves a defined outcome.
Start by asking whether a simpler deterministic system can meet the need. If AI is justified, control its context, authority, release evidence, and operation.
Control the uncertainty you introduce.
Use the steps that match the system’s consequence and authority. This is a review path, not a mandatory delivery process.
Simpler optionCan deterministic software meet the need?
Failure to prevent
AI adds uncertainty and operating cost without a clear benefit.
Evidence to keep
The simpler option considered and the reason it is insufficient.
ContextWhich information may the system use?
Failure to prevent
Unauthorized, stale, or untrusted context influences the result.
Evidence to keep
Source, access rule, provenance, and freshness requirement.
AuthorityWhat may the system propose or perform?
Failure to prevent
Model output becomes permission to act.
Evidence to keep
Allowed actions, policy checks, approvals, limits, and receipts.
EvaluationWhich failures must block release?
Failure to prevent
An average score hides severe or high-consequence failures.
Evidence to keep
Representative cases, owned thresholds, and reviewed exceptions.
ReleaseDoes the evidence match this exact system version?
Failure to prevent
Prototype confidence is applied to a changed production system.
Evidence to keep
Model, prompt, data, tool, policy, fallback, and approval versions.
OperationCan the workflow outcome and side effects be traced?
Failure to prevent
Provider metrics look healthy while the user workflow fails.
Evidence to keep
Outcome signals, traces, cost limits, and a degradation path.
Revise or stopWho can narrow, pause, or end the system?
Failure to prevent
The system keeps operating after its justification has changed.
Evidence to keep
Owner, review trigger, termination condition, and shutdown path.
Separate what the system knows, does, ships, and continues.
Context limits what the system can know. Authority limits what it can do. Evaluation limits what may ship. Operations determine whether it should continue.
Outcome contractUser value · prohibited outcomes · owner
CapabilityModel · retrieval · tools · workflow · agent
Authority boundaryIdentity · policy · approval · budget · termination
Evidence loopEvaluation · traces · receipts · incidents · cost
Operate, review, narrow, or stop Before release, can you answer these questions?
- Why is AI necessary for this outcome?
- Which context and actions are authorized?
- Which failures block release?
- Which fallback limits harm?
- Who can narrow, pause, or stop the system?