Two pages that show where AI already acts in your production, who checks it, whether you have a process at all, and which path you are on: Start or Fix.
I would fill this in alone, before anything else. Bring the software bill and the list of what shipped, both from last month, plus the support inbox and the chat channel where people post what AI made for them.
Twenty minutes, plus the inventory: ten more minutes near 25 people, or a day for whoever runs the bill at about 150. Do not ask the team yet.
The score in section B sets the path. The path is a reading order, not a verdict.
| Rule for filling it in | Why |
|---|---|
| Write what happens, not what should happen | The real process is in the pull requests and the support inbox, not on the wiki |
| A blank is a finding | Write "nobody" if you know nobody does it, "unknown" if you do not know. One question to the person closest to that row turns "unknown" into a name or "nobody" |
| Do not survey the team yet | My judgment: asking first turns the inventory into a survey nobody answers. One direct question to settle an "unknown" is fine |
| Free tools count | Browser extensions, free tiers, a personal subscription someone expenses. If it produced something that shipped, it is on the list |
Company: {{name}}. Size: {{number}} people. Date: {{date}}. Filled in by: {{name}}. Inventory by: {{name}}. Time taken: {{minutes}}.
One row per tool in the Inventory database below. Find the tools in three places: the bill, last month's shipped changes (an agent's name on a commit, a pull request that says it was generated), and the chat channel. Then add the free tools you already know about. At about 150 people, hand this section to whoever runs the bill: they sample the last 20 merged pull requests and one week of the channel. Pick the highest class that applies in each column, so the rows can be compared.
| Count | Number | What it tells you |
|---|---|---|
| Tools that take source code, customer records or credentials | {{n}} | Each one needs a named owner before anything else. My judgment |
| Outputs that reach a customer with "nobody" checking | {{n}} | A support bot at Cursor, about 60 to 150 people, stated a policy that did not exist, and reading it first was nobody's job (C12) |
| Rows with "nobody" for exceptions | {{n}} | Whoever gets burned finds out first. One named person is the cheapest fix on this page |
| Rows still "unknown" | {{n}} | Each one is a question to ask this week |
Answer from what actually happens, not from the wiki.
| Step | Who does it, by name | What says "done" (a merge, a ticket state, a checklist, a message, nothing) | Has AI changed what this step produces? | Is a human decision named here? |
|---|---|---|---|---|
| Discovery: what to build and why | {{name}} | {{signal}} | {{yes or no}} | {{who decides what}} |
| Design: what the customer will see and do | {{name}} | {{signal}} | {{yes or no}} | {{who decides what}} |
| Build: making it | {{name}} | {{signal}} | {{yes or no}} | {{who decides what}} |
| Review: checking it before it goes | {{name}} | {{signal}} | {{yes or no}} | {{who decides what}} |
| Release: putting it in front of customers | {{name}} | {{signal}} | {{yes or no}} | {{who decides what}} |
| Operate: keeping it running | {{name}} | {{signal}} | {{yes or no}} | {{who decides what}} |
| Support: answering customers | {{name}} | {{signal}} | {{yes or no}} | {{who decides what}} |
Steps with a named person and a done signal: {{n}} of 7. Five or more means Fix. Fewer means Start. A step with "unknown" in it does not count until the question is asked.
Steps where AI changed the output but the step did not change: {{n}} of 7. This is where review becomes the bottleneck, and checking eats the time that generating saved (C01, C06; source 14).
For week one, not today: ask three people, one at a time, to list the steps from idea to customer. Asked by {{date}}. Same list: {{yes or no}}.
Yes or no. Flags 1 to 4 are this week's work on either path, whatever the route in D.
| # | Flag | Raised? | If yes, this week | Closed by, on | Behind it |
|---|---|---|---|---|---|
| 1 | An AI agent or tool has write access to production data or a customer channel, with no separate test environment in between | {{yes or no}} | Remove the access or separate the environments. Buy the separation from your hosting or database vendor | {{name, date}} | An agent on Replit's platform, low hundreds of people by estimate, deleted a customer's production database (CF1) |
| 2 | An AI reply reaches a customer with nobody reading it first, and it is not labeled as AI | {{yes or no}} | Label every AI reply. Name one person who reads a sample every week | {{name, date}} | Cursor, about 60 to 150 people (C12). Klarna, about 3,500, saw quality fall and added a human option (CF3) |
| 3 | Source code, customer records, contracts or credentials go into a tool with no named owner | {{yes or no}} | Name one owner. Write two lines: what may go in, what may not | {{name, date}} | Shadow AI in breach research, vendor (F9) |
| 4 | A security or data access report can be closed by one person, with no second look | {{yes or no}} | Name an escalation path for anything touching login or data access | {{name, date}} | At Lovable, about 100 to 150 by estimate, such a flaw stayed open 48 days (CF6) |
| 5 | UI reaches customers with nobody but its author having looked at it | {{yes or no}} | Whoever reviews opens the preview before the diff | Linear's cofounder, about 100 to 300 people, on generated design without the thinking (C03) | |
| 6 | The review queue is more than a week old, or changes merge because nobody has time to read them | {{yes or no}} | Count the queue. Take the number to part 01 | A 15 person company hit 60 open pull requests before it redesigned review (C06) | |
| 7 | People hide their AI use, or work gets rejected because it looks AI generated | {{yes or no}} | Say in writing that AI use is allowed, with the two lines from flag 3, and that work is judged by whether it works | Reported at a dinner of 13 engineering leaders (C23) | |
| 8 | Nobody can say whether AI made anything faster, slower, better or worse | {{yes or no}} | Pick one number and start counting (part 06) | Fewer than one in five organizations measure it (source 15) |
Flags raised: {{n}} of 8. Flags 1 to 4 raised: {{n}}, all closed by {{date, this week}}.