Choose internal AI copilot use cases by four properties of the workflow rather than by a list of popular ideas. Is there an authoritative source the answers can come from? Can the assistant respect who may see what? How costly is a wrong output, and can it be caught? Does a person naturally review the output before it takes effect? Workflows that pass all four make good first copilots. Measuring whether a pilot pays off comes next; our guide to measuring internal copilot pilots covers baselines and total cost.
Evidence. Good candidates rest on maintained sources with named owners: policies, product sheets, approved case studies, runbooks and clause libraries. If correct answers depend on tacit knowledge, outdated files or facts people dispute, the assistant may fill gaps with plausible guesses unless it can reliably abstain and escalate.
Permissions. The sources need access rules that the system can enforce before the model reads anything. When the same question has different correct answers for different people, such as salary bands or deal terms, permission filtering must be built and tested before launch. Our enterprise RAG guide explains how to authorize at retrieval time.
Error cost. Ask what happens when an output is wrong. Some errors cost a few minutes of rework; others cause a wrong payment, a misleading message to a customer or a compliance breach. Note also whether the effect can be reversed.
Human review. Look for a natural checkpoint where a person reviews the output before it has an effect: a seller edits a draft before sending it, or an engineer decides whether to run a suggested command. Where the output reaches its target without review, such as an answer an employee acts on directly, the system must carry more of the safety burden through citations, declines and escalation.
Figure 1 — Check four conditions. Review before effects.
The following assessments are illustrative, not results from any client:
- First drafts of sales proposals. Evidence: approved product sheets and case studies. Permissions: deal data restricted to the account team. Error cost: high if sent unreviewed; drafting reduces action risk but still carries disclosure and reliance risks. Review: the seller edits before sending. A strong first candidate, scoped as a drafting aid.
- HR policy questions. Evidence: an employee handbook with an owner. Permissions: mostly open to all staff, with some restricted policies. Error cost: moderate, for example a wrong leave entitlement. Review: none at the moment of answering. Workable if answers cite the policy, decline when it is silent and offer an escalation path.
- IT operations runbooks. Evidence: runbooks of uneven quality. Permissions: the operations team. Error cost: high if commands run automatically. Review: the engineer executes each step. For this first pilot, suitable for suggesting steps without executing them, and only after the runbooks are cleaned up.
- Questions about sales figures. Evidence: a database, not documents. Error cost: wrong numbers can drive wrong decisions. Permissions: enforce access to the allowed rows and fields. Review: showing a query alone does not validate the figures. Prefer approved read-only queries, deterministic aggregation and checks against known results; consider this separately from a document assistant.
Scoring candidates this way usually makes the first choice obvious, and it shows what preparation the others need.
Anthropic's engineering guidance on building agents distinguishes workflows, in which models and tools follow predefined code paths, from agents, in which the model directs its own process and tool use, and it recommends starting with the simplest solution that works. Most first internal copilots fit the workflow pattern: retrieve approved sources, draft or answer, and hand the result to a person. Keep the first version read-only. Tools that send, update or pay belong in a later phase with explicit approval rules; our CTO playbook for AI agents covers when that autonomy is justified.
A review step only protects you if reviewers can do it well. Place it at the point of effect, before sending, filing or executing. Make it fast: show the sources next to each claim, flag unsupported claims and failed evidence checks rather than relying on the model to report its own uncertainty and show what changed from a template. Then check that review is real rather than a rubber stamp by sampling reviewed outputs, tracking how often reviewers edit and naming who is accountable for what leaves the team.
Figure 2 — Keep the pilot read-only. A person controls the final action.
Internal does not mean low risk for data. Prompts often contain personal or confidential information, so treat them as records: restrict who can read logs, set retention limits, and minimize or redact sensitive text. If the workflow processes personal data in Saudi Arabia, our PDPL data-flow checklist lists the questions to settle with your legal team.
NIST's Generative AI Profile (NIST AI 600-1), published on 26 July 2024 to extend the AI Risk Management Framework, catalogs generative AI risks such as confabulation, data privacy and information security. It is voluntary guidance and a useful screening checklist for a candidate workflow; it does not certify the system or make it safe.
Choose the candidate with the strongest evidence base, enforceable permissions, a low or catchable error cost and a natural review step. Agree before building what success means: which tasks, which measures and which baseline you will compare against. Run it with one team, turn failures into minimized, permitted regression examples, with appropriate access and retention controls, and decide on evidence whether to widen, adjust or stop.
These criteria are TecnoStack's guidance, not requirements from Anthropic or NIST. If you are choosing where to apply AI inside your organization, our AI automations service can help you assess candidate workflows and build the first one.
- Anthropic. Building effective agents: distinguishes predefined workflows from agents and recommends starting with the simplest solution; its December 2024 examples are marked historical.
- National Institute of Standards and Technology. Generative Artificial Intelligence Profile (NIST AI 600-1), published 26 July 2024 as a companion to the AI RMF.
