Restricting high-impact AI uses in knowledge work

Classify the action and consequence

Start with the actual action, not the tool name. Distinguish drafting a note, recommending an option, ranking people, determining access, changing a financial record, approving a payment, denying a service, or triggering an external communication. Record who is affected, whether the action is reversible, how quickly harm could occur, and whether another person can meaningfully review it before the consequence takes effect.

Do not assume that every use in a regulated function is legally “high-risk,” or that a low-cost tool creates a low-impact decision. Applicable classifications depend on jurisdiction, role, intended purpose, deployment context, and current law. The official EU Artificial Intelligence Act text contains prohibited practices, classification rules for high-risk systems, and obligations for covered operators. Its scope and phased application require current legal interpretation; a workplace guide cannot determine compliance from a short description.

Sources: [1]

Write the restriction as an operating rule

For each use, specify what the system may do, what it must not do, what evidence must be present, who may approve the next step, and what event stops processing. Avoid wording such as “human in the loop” unless the human has time, information, competence, authority, and a practical way to change the outcome.

A restriction might allow AI to extract fields from a non-sensitive synthetic case, prohibit it from issuing a final eligibility decision, require source-to-field reconciliation, and route uncertain items to an authorised reviewer. Another might permit drafting a customer response while preventing automatic sending, requiring factual verification, and blocking use of unapproved personal data.

The NIST AI RMF Govern guidance calls for documented legal and regulatory requirements, risk-tolerance-based activity, clear roles, and transparent policies and processes. NIST presents the framework as voluntary guidance. It supports disciplined governance but does not decide which laws apply or whether a control is effective in a particular organization.

Sources: [2]

Worked artifact: a synthetic benefits-support triage

Imagine a synthetic public-service team considering AI assistance for incoming benefits-support messages. The proposed system can summarize the message, identify missing documents, and draft a routing suggestion. The decision card marks denial, eligibility determination, fraud accusation, and benefit calculation as prohibited automated actions. It permits drafting only when a caseworker sees the source message and the draft together.

During a controlled exercise, the model interprets a late document as evidence that an applicant missed a deadline. The card requires the reviewer to check the governing notice and the message timestamp. The reviewer finds that the document arrived within an extension recorded in another system. The routing suggestion is rejected, the case remains open, and the cross-system lookup is added as a required check.

The retained artifact contains the proposed use, restriction rationale, source systems, test cases, false-positive disposition, human authority, escalation route, expiry date, and approval record. The scenario is synthetic. It does not establish that the workflow complies with any benefits law or that the proposed safeguards are sufficient in production.

Test meaningful human authority

A person cannot provide meaningful review if the interface hides source evidence, the deadline makes checking impossible, or the organization penalizes disagreement with the system. Test whether reviewers can see the original materials, obtain missing context, record a contrary decision, pause the workflow, escalate uncertainty, and identify who owns the final consequence.

Use deliberately varied cases: incomplete inputs, conflicting records, ambiguous policy, protected or sensitive data, urgent requests, and plausible but unsupported model explanations. Record both caught and missed failures. A passing demonstration should show the allowed contribution, the required check, and the exercised stop mechanism—not merely that a reviewer clicked approve.

Reassess scope and restrictions

Review the card after changes to intended purpose, affected population, jurisdiction, model, data, integration, permissions, autonomy, or downstream decision. Compare actual logs and sampled outputs with the written rule. Treat repeated overrides, missing evidence, reviewer delay, and workarounds as signals that the operating design may not match the stated restriction.

This method supports bounded governance decisions. It does not provide a legal conclusion, certify control effectiveness, or make a prohibited use acceptable. Two Prune may use synthetic work simulations to observe how a participant recognizes boundaries, checks evidence, and escalates uncertainty. It does not determine legal status or make decisions about employment, benefits, credit, or access to services.