Before You Automate

Module 2.3

Put the controls in before you hand off

Automation is one of AI’s highest-value uses — it takes repetitive work off your hands at scale. It is also where AI risk changes category. A bad draft can be corrected. A bad automated action can propagate before anyone notices.

Answers: Automation Drift →

How you’d notice it’s drifting

The output changes character over time — tone, format, or length drifting from what it produced when you first trusted it.
Volume or frequency runs past the range you expected — more actions, messages, or transactions than the task should generate.
The logs you set up quietly stop being read, and silence gets mistaken for success.

What drift looks like in practice.

Imagine a small business points AI at its inbox to auto-answer customer email. For a week it is accurate. Then a wording change leads it to start promising refunds the business never offered. Volume looked normal and no one was reading the logs, so it ran for three days before a complaint surfaced it — the three symptoms above, in order.

Never give AI broad, unmonitored access to email, files, production systems, customer accounts, payment systems, trading platforms, or administrative tools.

This is the Risk Ladder’s top rung: Prohibited Without Governance →

Rule: No automation at Medium risk or above should be deployed without a documented rollback procedure you can run fast enough to stop damage before it compounds — treat five minutes as the ceiling, not the target. That figure is a practical design heuristic — short enough to keep a bad action from spreading — not an industry standard.

What a rollback procedure looks like

Who executes it: Name the person responsible before deployment — not during an incident.

What step disables or reverts it: One specific, documented action. If this step requires more than one person or more than one action, the procedure is incomplete.

How you confirm it took effect: One observable outcome. If you cannot describe this before deploying, you are not ready to deploy.

Required controls

Put these in before the first automated run — not after the first incident. The right-hand column shows the lowest risk level at which each control becomes non-negotiable, following this page’s own rules: operational controls from Medium, human-oversight controls from High. Working alone scales these down, not out: the approval gate is you pausing to check before the action runs, the test environment is a dry run on dummy data, and the escalation path is knowing the point at which you stop it yourself.

Control	Purpose	Required from
Human approval gate	Prevents AI from becoming the decision-maker.	High
Scoped permissions	Limits what the system can access or change.	Medium
Logging	Creates an audit trail for review and liability.	Medium
Revocation capability	Allows access to be shut off quickly.	Medium
Test environment	Prevents live damage during experimentation.	Medium
Error handling	Defines what happens when output is uncertain or wrong.	Medium
Escalation path	Identifies who decides when the system fails.	High
Documented rollback procedure	Ensures recovery is possible and fast.	Medium
Periodic retesting	Detects drift and degradation over time.	Medium

Human-in-the-loop is mandatory at High and Critical risk levels. This is not a best practice. It is the rule.

OWASP LLM Top 10 documents the most common technical attack vectors for deployed AI systems. Reference it when building any production deployment. See the Appendix for the full citation.