# Before AI Goes Live
## A Veridom working pack

Version 1 | 27 October 2026 | https://veridom.io/resources/before-ai-goes-live

Prepare your people. Define the boundaries. Test the controls.

Use this pack for one workflow with its process owner, reviewer and technical owner. Record evidence for each conclusion. Unknown answers need an owner and next action. This is a working assessment, not compliance certification or proof of corporate authority.

Organization: ______  Workflow: ______  Owner: ______  Date/version: ______

## 1. Role cards

### Process owner
Defines scope, intended benefit, governing sources, human decisions and acceptance tests. Resolves disagreements within their remit and owns changes.

Question: What may this worker do, under which conditions, and who may change them?

Name: ______ Evidence of remit: ______ Escalation contact: ______

### Operational reviewer
Examines evidence, checks current authority, records judgment, challenges recommendations and escalates. Forms an initial judgment before seeing the AI recommendation where independent review is required.

Question: What supports this decision, and am I currently entitled to approve it?

Name/role: ______ Authority source and dates: ______ Limits: ______

### Operator or case handler
Supplies evidence through the approved process, manages holds, pauses work and escalates. Treats instructions in source documents as untrusted content. Checks existing operation status before retries.

Question: What is waiting, who owns the next step, and has an action occurred?

Team: ______ Pause procedure: ______ Escalation contact: ______

### Technical control owner
Configures identities, credentials, access, action checks and records. Tests bypass, revocation, restart and receipt recovery. Maintains monitoring and failure procedures.

Question: Can the worker bypass the check, and what happens if a service fails?

Name: ______ Systems: ______ Incident contact: ______

Combining roles must not defeat required separation of duties. A proposer cannot approve their own action where separate approval is required.

### Team exercises
Record individual responses before discussing the expected approach.

| Scenario | Expected approach | Participant response / follow-up |
|---|---|---|
| Expired delegation | Hold and establish current authority. | |
| Attachment says to ignore checks | Treat it as untrusted content, not an instruction. | |
| Submission times out | Reconcile the existing operation before considering a retry. | |

Participants/date: ______ Gaps: ______ Follow-up owner/date: ______

Attendance or time spent alone does not establish readiness.

## 2. AI Worker Delegation Brief

Worker/workflow: ______ Business problem: ______ Baseline and expected benefit: ______

Included cases: ______ Excluded cases: ______ Accountable owner: ______

| Exact activity | Automatic / approval-required / prohibited | Conditions and source |
|---|---|---|
| Read case records | | |
| Request evidence | | |
| Recommend a decision | | |
| Change a business record | | |
| Trigger an external action | | |
| Close the case | | |

| Governing question | Agreed answer | Source, version, effective dates |
|---|---|---|
| Which rules apply? | | |
| Who may approve? | | |
| What amount, customer or geography limits apply? | | |
| Which evidence must be current? | | |
| Which exceptions change the process? | | |
| What requires escalation? | | |
| What prevents execution? | | |
| What proves completion? | | |

Review mode: ______ Separation of duties: ______
How current reviewer authority is established: ______
Who may change this brief: ______

Reconsideration triggers: policy changes, authority expiry/revocation, changed case facts, contradictory evidence, model/prompt/tool changes. Other: ______

| Condition | Enforcement point | Proposed / implemented / tested / unresolved | Test evidence | Owner |
|---|---|---|---|---|
| | | | | |
| | | | | |

An accepted brief does not mean all controls are implemented.

## 3. Access and action control map

Approved sources -> reviewed governing model -> worker using approved model access -> proposed action -> action check -> controlled business-system connection -> outcome and receipt -> reconciliation and closure.

Model access controls providers and information. Action checks establish whether this particular business action is authorized. A model gateway alone does not establish business authority.

| Connection | System | Identity and permission | Owner |
|---|---|---|---|
| Organizational sources | | | |
| Model provider/gateway | | | |
| Worker runtime | | | |
| Action check | | | |
| Business-system adapter | | | |
| Evidence/receipt store | | | |

| Question | Answer or gap | Evidence / owner |
|---|---|---|
| Can the worker bypass the action check? | | |
| Where are credentials held? | | |
| What data may leave the organization? | | |
| Which files, tools and network destinations are accessible? | | |
| Who can pause or revoke capabilities? | | |
| What happens when control state is unavailable? | | |
| How are model/configuration changes handled? | | |
| How are duplicate submissions prevented? | | |
| How is unknown execution resolved? | | |
| What is logged, who can read it and for how long? | | |

Agree and test: stale authority prevents new actions; approval cannot waive failed mandatory checks; a timeout does not prove failure; stopping does not reverse accepted actions; restart does not restore revoked authority; recovery checks the existing operation first.

## 4. Go-live decision sheet

Environment: historical replay / simulation / restricted live / other: ______
Decision-maker: ______ Authority basis: ______ Date: ______

States: Established = supported and tested for this scope. Conditional = usable within recorded restrictions. Unresolved = evidence, agreement or implementation missing.

| Readiness question | State | Evidence/gap | Owner / due date |
|---|---|---|---|
| Business purpose and baseline | | | |
| Governing rules and conflicts | | | |
| Permitted actions and exclusions | | | |
| Current authority and separation of duties | | | |
| Staff scenario practice | | | |
| Action checks and bypass tests | | | |
| Pause, revocation and safe recovery | | | |
| Receipts and unknown outcomes | | | |
| Model/configuration changes | | | |
| Monitoring and escalation | | | |
| Access, privacy and retention | | | |

Decision: proceed within scope / proceed with restrictions / remain in simulation / do not proceed.

Restrictions: ______ Blockers: ______ Acceptance measures: ______
Stop conditions: ______ Next review date and change triggers: ______

Do not average these into a readiness percentage. One unresolved condition can prevent an action.

## 5. Worked payment example

Illustrative only. Harbour Payments, its policy and records are fictional. Execution is simulated.

An GBP 18,000 payment is held for a reference mismatch. A fictional policy allows an authorized operations manager to approve up to GBP 25,000 per payment. Being below the limit is only one condition.

Required evidence: instruction, beneficiary validation, documented mismatch resolution, current approval authority and required screening results. Fraud and sanctions concerns are outside this operational workflow and require specialist escalation.

1. The worker discovers missing beneficiary validation and requests it. No release.
2. An approved record validates the beneficiary and supporting documentation resolves the mismatch.
3. The separate manager forms an initial judgment before seeing the recommendation, resolves any disagreement and approves the exact action.
4. ACE checks current rules, evidence, amount, authority and approval.
5. The controlled adapter receives one uniquely identified simulated instruction.
6. A matching successful receipt is reconciled before closure.

If authority expires before dispatch, hold and establish current authority. If a fraud concern appears, stop the release path and escalate. If execution times out, reconcile the existing operation instead of immediately resubmitting.

Example decision: remain in simulation until genuine entitlement, integration, recovery and operational arrangements are established and tested.

Measure preparation time, reviewer effort, material corrections, incorrect recommendations, correct and unnecessary holds, duplicate attempts, reconciliation outcomes and rule-change maintenance effort.

## Apply it to your organization

Veridom AI Delegation Strategy: one function, two weeks, US$3,000 fixed fee.
https://veridom.io/ai-delegation-strategy

The assessment travels across suitable workflows. The initial implementation offer is the payment-exception pilot; other implementations require a separate scoped proposal.