How a request gets classified, and why

Triage decides how much review a request deserves. The questions are published, the rules are deterministic, and every classification shows the answers that produced it — so a requester who disagrees has something specific to argue with.

The three pathways

Standard enablement

Get out of the way. These requests are answered with guidance, not review — the goal is same-week resolution.

Target timeline: Answered in the weekly triage, typically within five business days
Typical examples: Summarizing nonsensitive internal material
Drafting internal content and correspondence
Brainstorming, outlining, and rewriting for clarity
Using an approved tool in the way it was already approved for, with human review
Required reviewers: AI Program Manager confirms the pathway
No functional review required
Required documentation: Register entry
Link to the relevant quick reference or guidance page
Human oversight: The person using the output is accountable for it
Nothing is shared externally without the author reading it first
Decisions available: Proceed with existing guidance
Proceed and add a quick reference if the question recurs
Reclassify upward if an answer changes

Structured review

One coordinated review with the two or three functions that actually have a stake, held on a scheduled date rather than routed through separate queues.

Target timeline: Two to three weeks from complete submission to decision
Typical examples: Workflow integrations with existing business systems
Confidential firm or client information in scope
External or client-facing content
A new vendor or a tool outside its approved scope
Material operational decisions informed by the output
Required reviewers: Information Security
Risk, Legal & Privacy where client or contractual terms apply
Data & Reporting where a document collection or data source is in scope
Business owner
Required documentation: Completed use-case record
Vendor evaluation worksheet if the tool is new
Human-oversight plan
Pilot measurement plan with a baseline
Human oversight: Named reviewer on every output that leaves the firm
Defined sampling or full-review expectation, written down rather than assumed
Errors and corrections logged during the pilot, not just at the end
Decisions available: Approve for pilot
Approve with conditions
Reduce scope
Return for more information
Decline

Elevated review

Slow down on purpose. These use cases can affect people's livelihoods, rights, safety, money, or the firm's professional standing, and the review has to be able to withstand scrutiny later.

Target timeline: Four to six weeks, longer if the evidence a reviewer needs does not exist yet
Typical examples: Employment decisions, recruiting, evaluation, or workforce impact
Sensitive personal data or regulated information
Autonomous or semi-autonomous action in a business system of record
Consequential decisions about individuals or clients
High-impact public output attributed to the firm or a licensed professional
Required reviewers: AI Governance Committee
Risk, Legal & Privacy
Information Security
People & Culture where employment is in scope
Business owner and the functional owner of the affected process
Required documentation: Completed use-case record with the affected population described
Vendor evaluation worksheet including any fairness or validation evidence the vendor can produce
Human-oversight plan naming who reviews what, how often, and with what authority to override
Measurement plan covering harm indicators, not only benefits
Decision record capturing alternatives considered and rejected
Human oversight: A named person makes every consequential determination; the tool never decides
Reviewers can see and override the tool's contribution, and know they are expected to
Monitoring for disparate effects on affected groups, reviewed on a defined schedule
A written stop condition and someone with authority to invoke it
Decisions available: Approve with conditions
Approve a reduced scope that removes the consequential element
Defer pending specific evidence
Decline

The rules, in full

Nine questions, read top to bottom. The highest pathway any rule raises wins. There is no weighting, no threshold, and no score — a number would tell a requester nothing they could act on.

R-01Raises to elevated review
Does this use case affect employment or other decisions about individuals?
Decisions about people carry consequences that are hard to reverse and hard to explain after the fact. These need People & Culture and Risk in the room before anything is built.
R-02Raises to elevated review
Is sensitive personal or regulated data involved?
Sensitive and regulated data brings obligations that belong to Risk, Legal, and Privacy, not to the requesting team or the program.
R-03Raises to elevated review
Will the tool take action in a business system rather than only suggest?
Suggestion errors get caught by a person. Action errors get caught by whoever finds them later, in a system of record.
R-04Raises to elevated review
Is human review proposed for every output?
Sampled or absent review can be appropriate for low-consequence work, but combined with action-taking or people-affecting use, it removes the last check.
R-05Raises to structured review
Will output be public-facing or client-facing?
Errors that leave the firm cost more to correct than errors caught internally, and they attach to the firm's professional reputation.
R-06Raises to structured review
Is confidential firm or client information in scope?
Client agreements vary, and confidential material needs a check on where it is processed and who else could see it.
R-07Raises to structured review
Is the tool new, unreviewed, or being used outside its approved scope?
An approval covers a specific tool doing a specific thing with specific data. Outside that, the earlier review does not apply.
R-08Raises to structured review
Is the intended rollout firmwide?
Firmwide scope multiplies small problems and usually means training, support, and a license commitment that Finance needs visibility into.
R-09Raises to structured review
Is the tool approved with conditions that this use case has to satisfy?
Conditions exist for a reason. Somebody has to confirm this use case meets them rather than assuming it does.

Run it

The same rules the register uses. Load one of the three recorded use cases, or change an answer and watch the classification move.

Load a registered use case, or change any answer below to see what moves.

Result

Standard enablement

Get out of the way. These requests are answered with guidance, not review — the goal is same-week resolution.

Target timeline: Answered in the weekly triage, typically within five business days

No rule fired

Nothing in these answers raises the request above standard enablement. The record says so explicitly, which matters as much as the fast answer — anyone who asks later why this moved quickly can see the reasoning.

What this pathway requires

Reviewers: AI Program Manager confirms the pathway; No functional review required
Documentation: Register entry; Link to the relevant quick reference or guidance page
Human oversight: The person using the output is accountable for it; Nothing is shared externally without the author reading it first
Decisions available: Proceed with existing guidance; Proceed and add a quick reference if the question recurs; Reclassify upward if an answer changes

This is a demonstration triage model built to show how classification can be made explainable. It is not a legal determination, a compliance assessment, or a production risk-scoring system. In a real organization the questions and thresholds would be written with Risk, Legal, Privacy, Security, and HR, and reviewed on a schedule.

Policy, legal, privacy, security, budget, vendor, and strategic decisions belong to their owners. This role coordinates the work, prepares the material, and records the outcome. It does not decide on their behalf.

Back to the brief