Intended use
What operational decision or deliverable does the output support, and what must the automation never decide?
DefinedThe process stays visible from approved source to human decision.
We use automation inside a controlled operating path. The proposal names the inputs, environment, acceptance test, people, evidence, and exclusions before confidential work begins.
Start with the boundary, not the model.
A useful scope can answer six questions without technical theater. If it cannot, the workflow is not ready to automate.
Source authority
Which systems, files, versions, and data classes are permitted, and who can authorize them?
NamedAcceptance test
Which representative examples, measures, exception rules, and reviewer checks determine whether the output is usable?
MeasuredDecision rights
Who can edit, reject, approve, release, escalate, and stop the workflow?
AssignedOperating responsibility
Who owns installation, access, support, incident handling, change control, retention, and exit?
RecordedExplicit exclusions
Which data, systems, roles, decisions, and outcome claims stay outside the engagement?
VisibleCapture and map. Then verify and resolve.
The second phase is not optional polish. It is where the output is checked against the source, failures are classified, and unclear items are held for a person.
Capture
Retrieve approved information through an authorized API, import, or controlled front-end route.
Map
Connect extracted fields and generated material to the target structure and source location.
Verify
Test representative output against agreed criteria and record error types and limits.
Resolve
Send exceptions, conflicts, and uncertain items to the named reviewer before use.
Deployment is a design choice with named responsibilities.
We can assess open-source-capable, client-controlled cloud, on-premises, or hybrid options. The label alone says nothing about privacy, security, compliance, validation, or support quality.
Client-controlled cloud
Scope tenancy, access, model/provider terms, data location, logs, retention, support, and client operations.
On-premises or hybrid
Assess infrastructure readiness, installation, updates, identity, observability, backups, incident roles, and exit planning.
Open-source-capable
Evaluate model and component licenses, maintenance, performance, security updates, hardware, and the evidence required for the intended use.
Important outputs carry their evidence trail.
Provenance means the source, version or date, source location, transformation, exception history, reviewer, and approval state can be inspected. The exact completeness and retention rules are part of the scope.
Illustrative output record
FieldRecorded valueState
SourceDocument + locationLinked
TransformRule + versionLogged
ExceptionReason + resolutionClosed
ReviewerRole + decisionNamed
Claims are limited by the evidence.
We will not convert an architecture preference into an outcome promise.
Does client-controlled or on-premises mean private?
Not by itself. Privacy depends on the actual data flow, access, model use, storage, support, retention, deletion, and incident responsibilities agreed for the engagement.
Can the workflow run without AI?
Yes. AI use is task-specific and requires client permission. A non-AI route can remain available when the material or environment requires it.
Do you guarantee extraction accuracy?
No. Accuracy is measured against an agreed test set and reported with limits, error types, and exceptions. Fitness for use remains an engagement-specific client decision.
Does an audit trail establish Part 11 or GxP compliance?
No. Intended use, the complete system, procedures, validation evidence, access, records, operations, and accountable client roles determine which requirements apply and whether they are met.
Who keeps the final decision?
The proposal names the client owner and any qualified reviewer required. Durability can prepare and coordinate; business, professional, and regulated decisions remain with the assigned people.
Put the controls in the scope.
We define the source set, intended use, environment, acceptance test, review path, operating responsibilities, and exclusions before proposing a build.