Free · 15 minutes
FOUNDERS · TEAMS · OPERATORSTrain the team
FIRST STEP SECOND STEP
Train the team
and test AI on one process.
Start with recurring work, output quality and risk. Choose a workflow that can be tested, handed to an owner and improved.
Diagnostic session $120 · 60 minutes · Credited toward a package purchased within 14 days.
Discuss diagnostic →ENGAGEMENTS
Three ways to start.
Fixed scope: process map, data boundaries and candidate backlog.
Discuss scope →Per 60-minute session; minimum 4 sessions, total from $1,560, maximum 5 people.
Discuss scope →One bounded workflow; scope cap 35 hours.
Discuss scope →SAFE AGENT WORK · 3 CASES + 5 RULES
Do not trust the plan. Control the effect.
An AI agent can read, decide and use tools. The risk starts when a plausible answer can turn directly into an external effect. These three documented cases show different failure modes.
Replit Agent deleted production-app database data.
During a SaaStr experiment, Replit Agent deleted app data from a database. Replit later acknowledged the problem publicly: before its new development/production separation, changes made during development could affect production; the data was restored through rollback.
Lesson: a written instruction such as “do not change anything” is weaker than a technical boundary that prevents the agent from writing to production.Replit · 29 Jul 2025 ↗EchoLeak showed that incoming data can become an instruction.
Researchers demonstrated an indirect prompt-injection chain in Microsoft 365 Copilot: a crafted email could enter Copilot context and enable data exfiltration without the user clicking the email. Microsoft patched the issue; public reporting said Microsoft had no evidence of in-the-wild exploitation.
Lesson: email, webpages, documents and comments are untrusted data even when an agent can read them automatically.SC Media · Microsoft CVE-2025-32711 ↗Unit 42 found hidden prompts on malicious webpages.
Unit 42 observed real webpages carrying indirect prompt injection, including an attempt to make an AI ad-review system approve a scam advertisement. The researchers explicitly noted that they had not confirmed a successful bypass of a deployed ad-checking agent in that case.
Lesson: an agent that reads the web must separate page content from commands, and it should not gain extra authority simply because automation is convenient.Palo Alto Networks Unit 42 ↗FIVE OPERATING RULES
Authority should be explicit.
- 01 · Start read-only
Let the agent read, plan and show a diff first. Grant write authority separately and only where one task actually requires it.
- 02 · Least privilege
Use test environments, separate accounts and keys, and no production access by default. Do not give an agent more authority than one task needs.
- 03 · Human before irreversible effects
Data deletion, publishing, sending messages, purchasing, payment or access changes require explicit confirmation before the effect.
- 04 · Data is not instruction
Text from email, webpages, files, issues or chat can be hostile. Retrieved content must not become a new command without a separate trust check.
- 05 · Verify after the effect
Keep an action log, verify the result, define rollback and a stop condition. “The agent said it is done” is not evidence.
The cases are not equivalent: Replit was a real operational incident; EchoLeak was a confirmed vulnerability patched before public disclosure with no known in-the-wild exploitation; the Unit 42 case was an observed malicious injection attempt without confirmed successful bypass of a deployed ad-review agent.
IMPLEMENTATION PILOT
One workflow. A testable operating model.
Map
Document the current process, inputs/outputs, owner, frequency, human checks and cost of failure.
Select
Choose one workflow with clear value and limited blast radius instead of pretending to automate the company in a week.
Prototype & test
Build a working version and test edge cases, quality, data boundaries, fallback and human checkpoints.
Handoff
Document ownership, operating rules, limitations, verification criteria and the next improvement backlog.
AI Pilot Simulator
Scope the process before the demo.
Four deterministic local scenarios: AI role, human checkpoint, success signal, stop condition and handoff. No data is sent.
Local demo · no data is sent
PILOT / 01
SOURCE-BOUNDInternal knowledge triage
01Candidate scopeRepeatable search across an approved knowledge base where every useful answer must map back to concrete sources.
02AI roleFinds candidate evidence, compares passages, drafts an answer and surfaces uncertainty.
03Human checkpointChecks the primary source, data access and approves the answer before operational use.
04Success signalA pre-agreed reviewer-acceptance and response-time threshold for source-backed answers.
05Stop conditionSources do not cover the question, access rights are unclear or review takes as long as the current process.
06Pilot artifactWorkflow spec + source rules + test set + fallback.
BUSINESS ECONOMICS · SCENARIO
Sensitivity, not a savings promise.
Local scenario · no data is sent
Formula: people × routine hours/week × 52/12 × selected recoverable share × hourly value.
This is a sensitivity scenario, not a forecast or savings guarantee. It excludes implementation, model/API, integration, QA, error, tax costs and whether recovered time can actually be monetized.
Brief text — copy manually
Good candidate
- repeatable knowledge work with a clear input and output
- documents, research, classification, drafting or decision preparation with human review
- an accountable process owner and a describable definition of good output
- a bounded pilot that does not require autonomous access to critical actions
Stop signals
- no process owner or nobody willing to review the output
- a fully autonomous safety-critical decision is required
- required data cannot be used or privacy boundaries are unclear
- the expectation is to replace people with one button without redesigning the process or controls
WHAT REMAINS
Example formats →Artifacts, not AI theatre.
Current-state map · candidate backlog · prototype · test cases · human checkpoints · privacy/data boundaries · owner & fallback · operating notes.
DECISION GATE
Ship · Revise · Stop.
Agree output quality, human review, failure modes, data boundaries, fallback and the process owner before building. Decide against those criteria, not demo appeal.
Ship
Criteria pass; the owner accepts the workflow and ongoing review.
Revise
Value exists, but bounded quality, data or operating-rule issues need correction.
Stop
STOP when risk, missing ownership or data constraints make adoption worse than the current process.
AFTER THE PILOT
Support with explicit limits.
4 hours per month
8 hours per month
Scope, schedule, payment, rescheduling, cancellation and refund terms are confirmed in writing before payment.
Six points are enough.
Process, people and owner, frequency, inputs, good output, and what happens if AI is wrong.
Prepare the brief →