Automation projects are rarely blocked by technology. They are blocked by an unanswered question from legal, risk or compliance about what the system is allowed to do and how you would prove it afterwards. This session covers how to answer that question before it is asked.
What is covered
- Policy outside the prompt: why refund ceilings and data rules belong in platform configuration evaluated independently of model output.
- Scoped tools: designing narrow, auditable actions instead of broad administrative access, with worked examples for refunds and account changes.
- Data handling: what an assistant may read, what it may repeat back, and how redaction is applied before retrieval.
- Audit trails: the record that makes an automated action reconstructable months later, including which policy version applied.
- The evidence pack: the four artefacts reviewers consistently ask for, shadow-mode results, graded evaluation set, guardrail configuration and rollback plan.
Who should watch
Operations leaders preparing an internal approval process, and the risk or compliance partners who will review it. Several of our customers watch it jointly with their compliance team, which is the use we designed it for.
Follow-on material
The evaluation approach discussed in the session is expanded in the Support QA scorecard pack, and the containment metrics referenced throughout come from the AI Deflection Benchmark Report.