Start with a job someone needs done
An organization rarely buys a model for its own sake. It wants shorter support queues, faster document review, better forecasting, or a new product. Start there. Describe the task, who relies on the result, and what happens if the result is wrong. “We use generative AI” is a technology description. “Staff use suggested answers when responding to customers” is a use case you can assess.
Separate the model from the application
The model produces a prediction or response. The application decides what information it receives, which tools it can call, where results appear, and what gets stored. A carefully chosen model can still sit inside a poorly controlled application. Draw a simple map showing the user, input sources, model service, retrieval layer, connected systems, and logs. Include external providers.
Look at how much authority it has
A drafting assistant and an agent that changes customer records may use the same underlying model. Their consequences differ because their authority differs. Ask whether outputs are suggestions, whether a person reviews them, and whether the system can act without another decision. Treat autonomy as a specific design choice, rather than a marketing label.
Think across the lifecycle
Risks change when a prototype becomes a shared service. Test data gives way to live information, access expands, and people begin depending on the output. Assign ownership for adoption, deployment, monitoring, major changes, and retirement. Revisit the assessment when the use case or its permissions change; a one-time review of the prototype does not describe the production system.
Make uncertainty useful
You may not know how a provider trained a model or why a particular answer appeared. Write down those limits and ask what evidence you can obtain instead. You can still test authorized access, trace data flows, measure performance on relevant tasks, and establish a way to stop the service. Useful governance turns unknowns into decisions and follow-up work.
PUT IT INTO PRACTICE
A useful next step
- Describe one use case in two plain sentences.
- Draw its data and action paths.
- Name the person accountable for the outcome.
- Record what would trigger another review.
Keep the result: record the decision, owner, supporting evidence, and the next review trigger.
Go to the source
These links support further learning. The worked example and practical exercise are SyruSec’s own educational interpretation.
