What this proves
I can put a model inside a governed product where the deterministic rules, not the model, own the decision.
Governed-AI Product Case Study
case-study · workflow-operator
AI Workflow Fit Operator
A triage tool that decides whether a workflow deserves AI at all. Ten routes, four blocking gates, and a Claude step that never gets the final word.
how it decides
AI is route nine of ten.
Describe a workflow, or upload the documents and confirm what it extracts. The operator walks the case down this ladder from the top and stops at the first rung that fits — one route, with the reasoning written down, which may well be fix your process first.
HARD GATES · CHECKED BEFORE ANYTHING IS SCORED
- controls critical infrastructure or physical operations
- makes consequential decisions on its own
- sensitive data in an unapproved environment
- irreversible and hard to review
- 01 Governance, security, or legal review a hard gate fired — triage stops here
- 02 More discovery first facts the route depends on are missing or disputed
- 03 Defer, or don't build no owner, no measurable outcome, or the work is disappearing
- 04 Clarify the policy first the rules keep shifting, or nobody can say what a correct result is
- 05 Fix the process first broken handoffs, unclear ownership
- 06 Fix the data first unusable data, no source of truth
- 07 Plain automation or integration stable, structured work — rules beat models
- 08 Training or change management first the gap is skill or adoption, not software
- 09 AI-assisted quick win · agentic workflow candidate only here is AI fit finally assessed
- 10 Defer, or don't build what's left is low value or disproportionate risk
Eight things outrank the AI question. A don't build this result is a successful output.
hiring signal
Risk handled
AI-fit tools flatter every idea into a pilot, quietly upgrade weak evidence to fact, and let a drafted answer slide into a decision nobody reviewed.
Evidence
Ten ranked routes with AI at nine, four gates that block before anything is scored, and a review lock that stops triage until a person confirms the drafted answers. 24 fixtures check all of it on every commit.
product screenshots
What the tool actually says.
Why it exists
Requests for AI arrive with the solution already chosen. Someone has seen a demo, and the ask is can we put AI on this? rather than what is actually wrong here? Often the honest answer is a clearer handoff, a cleaned-up source of truth, a policy decision nobody has made, or training on a tool the team already owns.
Saying that out loud in a room full of enthusiasm is hard. It is easier when the reasoning is written down before the conversation, applied the same way every time, and traceable afterward. That is what this operator is: the argument for restraint, encoded so it survives the meeting.
What made it hard
The tempting build is a scoring rubric: rate value, feasibility, and AI fit, then recommend a pilot above some threshold. That tool finds a way to say yes to almost anything, because a high score can always outweigh a quiet risk.
So scores do not select the route. A fixed precedence ladder does, and hard gates are evaluated before any score is read. A workflow that adjusts treatment plant settings can score maximum value, maximum feasibility, and maximum AI fit, and still route to governance review with autonomous action denied. That case is a regression fixture, not a hypothetical.
model authority
Claude drafts. It never decides.
CLAUDE SONNET 5 drafts intake answers from uploaded files web/backend/claude_adapter.py
HUMAN REVIEW keep · fix · hide · unsure draft_review_required blocks triage until a person confirms
DETERMINISTIC CORE schema validation → hard gates → route precedence → rendered report scripts/ · PyYAML only · zero network calls
WHAT THE MODEL CANNOT DO
- mint evidence the ledger is deterministic extraction plus human keep/fix/hide decisions
- upgrade its own confidence drafted fields are clamped to reported/low in Python, not by prompt instruction
- overwrite a human answer drafts fill blanks only; a draft may raise a sensitivity flag, never clear one
- reach the router scripts/ contains no network code at all
With no API key the app falls back to a deterministic no-network adapter and says so on screen. Any model failure — timeout, malformed JSON, budget exhausted — degrades to that same path with a visible notice, never an error.
How I know the gates still fire
Twenty-four fixtures with locked expected outputs run on every change. Fourteen cover the route matrix; ten are adversarial. They encode the failures I care about: a sponsor demanding AI against the evidence, instructions hidden inside an uploaded document, a vendor's perfect-accuracy claim, a savings estimate with no baseline, an emergency operation wearing a simple interface, and an oversight plan that no real person has the time or authority to perform.
The suite reports route agreement and safety-gate recall as separate numbers. Safety-gate recall has to stay at 100%. A gate that silently stops firing looks exactly like a gate that was never needed, which is why regenerating expected outputs to make a suite pass is the one move the contributor docs forbid.
decisions
What the constraints buy.
AI is route nine of ten
Chose
A fixed precedence ladder. Hard gates run first; then missing facts, no-build, policy, process, data, plain automation, and training. AI fit is assessed second to last.
Why
Most workflows that arrive with an AI idea attached have a process, data, or policy problem underneath. Scoring AI fit first finds a way to say yes to the wrong thing.
Cost
The tool's most common honest answer is 'fix your process first,' which is a worse demo and the entire point.
Claude drafts. It never decides.
Chose
Claude reads uploaded documents and drafts the intake answers. A draft sets draft_review_required, which blocks triage until a person confirms. Drafted fields are clamped to reported/low confidence in Python, drafts fill blanks only, and a draft may raise a sensitivity flag but never clear one.
Why
Extraction from messy documents is where a model genuinely helps, and it is exactly where unverified claims sneak in wearing the costume of a fact.
Cost
An extra mandatory review step, a fake no-network adapter kept as the default, and a clamp layer that has to be maintained alongside the schema.
The router has no network code
Chose
Routing, validation, gates, and rendering live in a stdlib-plus-PyYAML package with zero network calls. Model access exists only in a web-layer adapter. The FastAPI backend imports the same router the CLI uses.
Why
If the decision path can call a model, the decision is only as reproducible as that call. Two routing implementations would eventually disagree.
Cost
The web backend inherits the core's conservative dependency floor, and any model failure has to degrade to the deterministic path rather than surface an error.
The intake asks in the owner's language
Chose
A five-step guided form over eight sections, worded the way the person doing the work would say it — "What tells someone it is time to start?" rather than "trigger event." Risk gets a step to itself, where five sensitivity checkboxes feed the hard gates directly. Answers autosave as you go.
Why
The people who know a workflow are the people doing it, and none of the schema's vocabulary — boundary, sensitivity_flags, human_review — means anything to them. A form that speaks the framework's language only gets filled in by someone who already speaks it, which is the wrong person.
Cost
It is a long form, and the translation between plain questions and schema fields is hand-maintained, so every schema change has to be re-worded rather than just re-typed.
Twenty-four fixtures grade every change
Chose
Fourteen route-matrix cases plus ten adversarial ones: prompt injection inside source documents, sponsor pressure, vendor accuracy claims, impossible human review, savings claims with no baseline. Route agreement and safety-gate recall run in CI.
Why
A precedence ladder drifts silently. A gate that stops firing looks exactly like a gate that was never needed.
Cost
Every rule change means re-justifying expected outputs by hand. Regenerating them to make the suite green would defeat the purpose.
the stack
The stack.
- Python · stdlib + PyYAML
- FastAPI
- React 18
- Vite 6
- TypeScript 5
- Claude Sonnet 5 · drafting only
- anthropic SDK
- JSON Schema
- unittest · 87 tests
- 24 route + adversarial fixtures
- GitHub Actions
- Docker
- Fly.io
- Claude Code
Want the walkthrough, or the parts that aren’t written up yet?
jakerosow@gmail.com