AASIFWorked example · read-only
STEP 2 OF 7

Decide the grey areas

Decide how the agent behaves in situations nobody has specified yet. Start from an option and complete the blanks.

  1. 1Pick or write a decision for each grey area shown
  2. 2Fill in who, how and when
  3. 3Mark open points or flag 'I'm unsure' for expert review
14 of 14 answered

Missing data

What should the agent do when required information is missing?

Linked hazards:

Default decision owner: Process owner

In your use case, for example:

  • In step 'Pays supplier invoice', a required item is missing from the inputs (Matched invoice, vendor master bank details).
  • In step 'Matches invoice to purchase order', a field is empty and the agent would have to guess it.
Pick one to start from:

Conflicting information

What should the agent do when sources or instructions contradict each other?

Linked hazards:

Default decision owner: Process owner

In your use case, for example:

  • In step 'Pays supplier invoice', two inputs (Matched invoice, vendor master bank details) contradict each other on a key fact.
  • An instruction in a message contradicts the rules the agent follows in step 'Matches invoice to purchase order'.
Pick one to start from:

Limit reached

What should the agent do when an action would exceed a limit (amount, rate, budget)?

Linked hazards:

Default decision owner: Process owner + risk

In your use case, for example:

  • In step 'Pays supplier invoice', the agent would exceed a limit you set, for example on amount, number or scope.
  • A request is split into smaller parts so that each part stays below a limit in step 'Pays supplier invoice'.
Start from one or combine several:

Uncertainty

What should the agent do when it is unsure?

Linked hazards:

Default decision owner: Process owner

In your use case, for example:

  • In step 'Pays supplier invoice', the agent is unsure it has understood the case because the inputs (Matched invoice, vendor master bank details) are incomplete or ambiguous.
  • In step 'Matches invoice to purchase order', the agent handles a type of case that people have often had to correct before.
Pick one to start from:

Out-of-scope request

What should the agent do when asked to do something outside its task?

Linked hazards:

Default decision owner: Process owner + CISO

In your use case, for example:

  • A request asks the agent to change bank details.
  • An input of step 'Matches invoice to purchase order' (Invoice PDF from supplier email (untrusted), purchase order from the ordering agent) contains an instruction to the agent instead of plain information.
Pick one to start from:

First-time or unusual case

What should the agent do in a situation it has not seen before?

Linked hazards:

Default decision owner: Process owner

In your use case, for example:

  • In step 'Matches invoice to purchase order', the agent meets a case unlike anything it was tested on.
  • The volume or mix of cases in step 'Matches invoice to purchase order' suddenly changes.
Pick one to start from:

Suspected manipulation

What should the agent do when an input looks like fraud or manipulation?

Linked hazards:

Default decision owner: CISO + process owner

In your use case, for example:

  • An unverified message asks the agent for an urgent exception or change in step 'Pays supplier invoice'.
  • An input of step 'Matches invoice to purchase order' (Invoice PDF from supplier email (untrusted), purchase order from the ordering agent) contains hidden text that tries to give the agent instructions.
Start from one or combine several:
Open point

Failure mid-action

What happens when a system or tool fails halfway through an action?

Linked hazards:

Default decision owner: Engineering / IT

In your use case, for example:

  • A tool fails in step 'Pays supplier invoice': the payment is sent but not booked.
  • Step 'Matches invoice to purchase order' is interrupted and restarts, and the agent creates the same record twice.
Start from one or combine several:
Open point

Error discovered afterwards

Who corrects an error after the action, and how are affected parties informed?

Linked hazards:

Default decision owner: Process owner + legal

In your use case, for example:

  • Days later, someone finds a wrong payment from step 'Pays supplier invoice'.
  • A complaint from suppliers shows that step 'Sends payment advice email to supplier' went wrong some time ago.
  • Days later, someone finds a wrong record from step 'Matches invoice to purchase order'.
Start from one or combine several:
Open point

Objection by an affected person

How can an affected person question or appeal an outcome?

Linked hazards:

Default decision owner: Legal / compliance

In your use case, for example:

  • Suppliers disagree with an outcome of step 'Pays supplier invoice' and want a person to look at it.
  • Someone asks why the agent decided the way it did in step 'Sends payment advice email to supplier'.
Start from one or combine several:

Changed rules or context

Who updates the agent when business rules or regulations change?

Linked hazards:

Default decision owner: Process owner + compliance

In your use case, for example:

  • A rule or regulation that step 'Matches invoice to purchase order' relies on changes.
  • The business changes a policy that the agent applies in step 'Matches invoice to purchase order'.
Start from one or combine several:

Accountability

Who is accountable for the agent's decisions?

Linked hazards:

Default decision owner: Management

In your use case, for example:

  • Step 'Pays supplier invoice' produces a wrong payment, and nobody is clearly accountable for it.
  • The agent misbehaves in step 'Sends payment advice email to supplier', and someone has to decide whether to stop it.
  • Step 'Matches invoice to purchase order' produces a wrong record, and nobody is clearly accountable for it.
Start from one or combine several:

Data boundaries

Which data must the agent never use, store or pass on?

Linked hazards:

Default decision owner: Data protection officer

In your use case, for example:

  • The inputs of step 'Pays supplier invoice' (Matched invoice, vendor master bank details) contain personal or confidential details the agent does not need.
  • In step 'Sends payment advice email to supplier', the agent could pass one person's data to someone else or to a third party.
  • The inputs of step 'Matches invoice to purchase order' (Invoice PDF from supplier email (untrusted), purchase order from the ordering agent) contain personal or confidential details the agent does not need.
Start from one or combine several:
Open point

Switch-off and fallback

When is the agent stopped, and how does the process continue manually?

Linked hazards:

Default decision owner: Process owner

In your use case, for example:

  • The agent keeps making errors in step 'Pays supplier invoice' and has to be stopped.
  • The model or tool behind step 'Pays supplier invoice' is unavailable for a day.
Start from one or combine several:
Not applicable to your case (1)

These don't apply to your answers in step 1. Unanswered ones never become open points.

Human unavailable

What happens when the approver does not respond in time?

Linked hazards:

Default decision owner: Process owner

In your use case, for example:

  • In step 'Pays supplier invoice', the agent waits for an approval, but nobody responds before the deadline.
  • The usual approver for step 'Pays supplier invoice' is absent and no deputy is named.
Pick one to start from:

Step 2 complete — every grey area has a decision or an owner.

Back

Classification is deterministic — AI only adapts wording and suggests, you confirm.