If you put the same heavy check on every bot task, nothing gets done. If you put no checks on anything, something will go badly wrong. The trick is matching the check to the risk.
Risk-based thinking in ISO
ISO asks organizations to plan actions to address risks and opportunities. The idea is simple: put your controls where the risk is, in proportion to it.
You inspect a flight-critical part more closely than a shipping box.
Two-way doors and one-way doors
A handy way to sort tasks:
- Two-way doors can be undone. A draft, a note, a research summary. If it's wrong, you throw it out.
- One-way doors can't easily be undone. A sent email, a payment, a deleted file, a public post.
Two-way doors can go fast. One-way doors get a check and a yes.
A simple risk table
| Task | Undo it? | Who's affected | Rigor |
|---|---|---|---|
| Brainstorm ideas | Yes | Nobody yet | None |
| Summarize a document for you | Yes | You | Skim it |
| Draft a customer reply | Yes, until sent | Customer | Read before sending |
| Quote a price | Hard | Customer, money | Source check and yes |
| Pay an invoice | No | Money | Person approves every time |
| Delete records | No | Everyone | Person approves, backup first |
Whose money is at risk
Our AN Creation principles put it plainly: rigor scales with whose money is at risk. A bot playing with an idea is cheap. A bot committing a customer's money, or the company's, is not.
What "more rigor" looks like
- Low: no check, or a quick skim.
- Medium: a person reads it before it's used.
- High: sources required, a person checks the facts, a person approves.
- Highest: two checks, a record of the approval, and a way to undo if possible.
Risk changes over time
A new bot is riskier than one that's been tested for months. As a bot proves itself on one kind of task, the rigor on that task can come down a step, by decision, in writing. See Change on purpose.
Where bots differ
A person who's done a job a hundred times gets more reliable. A bot's reliability depends mostly on its instructions and its model. Change either and it can behave differently. So when you change a bot's model or skills, the rigor goes back up until it's tested again.
What this means for you
- Sort tasks into two-way and one-way doors.
- Let two-way doors go fast.
- Put sources, checks and a yes on one-way doors.
- Lower rigor only by decision, and raise it again after changes.
Fast where it's safe, careful where it counts. That's the whole idea.