THE ENTERPRISE AI FIELD GUIDE

Better questions.
Better decisions.

Practical material for the business, technology and governance teams bringing AI into their organisation.

01 / Pilot playbook

Start with one valuable question.

A focused pilot should prove useful work, not just produce an impressive answer.

Choose the work

Select one team and one repeatable task: a policy answer, an operational briefing or a document review. Name the person who will judge whether the output is useful.

Choose the evidence

Identify the source documents, their owners and the permissions the pilot must preserve. Include deliberately inaccessible material to test the boundary.

Agree success before starting

Measure answer correctness, citation quality, task completion and human review effort against a baseline. Record failures as carefully as successes.

Decide whether to expand

Review the evidence with users, IT and security. Expand the scope only after provider connections, operating costs and failure handling are understood.

Build your pilot brief

02 / Security checklist

The questions your CISO should ask.

A convincing security review follows the full path from identity to retrieval, model use and the resulting action.

Who is asking?

Verify the production identity provider, membership and group mapping. Demonstration persona switching is not evidence of production authentication.

What can they reach?

Test allowed and denied documents, cross-department access and connector permissions. Check that restricted content cannot leak through excerpts or tool results.

Where does the data go?

Inspect model routes, endpoint allowlists, secrets custody and network egress. Private and air-gapped claims need verification in the actual deployment.

What happens when it fails?

Exercise a rejected action, a provider outage and a restore. Verify audit records, retention and operational evidence before relying on them.

Explore the governance demonstration

03 / Deployment guide

Choose your operating boundary.

Cloud, on-premise and air-gapped deployments are operating decisions, not interchangeable marketing labels.

Classify the information

List which records may use an approved external model, which require private inference and which must remain in an isolated environment.

Account for the dependencies

Plan database, object storage, secrets, identity, queues and telemetry. Add isolated analysis or desktop brokers only when those capabilities are in scope.

Plan ownership

Assign owners for infrastructure, models, connectors, incident response and upgrades. Agree recovery objectives and the evidence needed to accept the release.

Validate before rollout

Complete dependency readiness, live-provider acceptance and recovery checks. An application build or a demonstration is not a production sign-off.

Compare deployment options

The next chapter is yours.

What could your
people do next?

Start with one question.
Discover what becomes possible.

Or explore AIOS

Better questions.Better decisions.