Lesson 6 of 6
Go/no-go for AI
8 min
Listen to this lesson
A go/no-go decision for an AI feature looks like any other in structure: evidence against agreed criteria, open risks with owners, a rollback plan and named people who decide. What differs is the content. The evidence is statistical, some risks can only be reduced and watched, and the monitoring plan matters as much as the test results, because behavior can change after go-live without a transport.
The evidence pack
| Section | Contents | Owner |
|---|---|---|
| Scope and intended use | Skills in scope, users and roles, what the agent must never do, systems it touches | Maria with the BTP team |
| Versions | Agent version, model version, evaluation set version, data seed, platform release | BTP team |
| Thresholds and results | The signed threshold sheet, results per skill, per-case consistency, comparison with any previous baseline | Priya |
| Safety results | Injection, disclosure, agency, leakage, misinformation and consumption cases, with every failure and its fix | Nadia |
| Human checkpoints | Which actions need confirmation, escalation limits, evidence they can't be bypassed | Maria and Dan |
| Residual risks | Known failure modes still possible, their likelihood from the runs, mitigations and owners | Priya and Grace |
| Monitoring and rollback | What is watched, how often, by whom, and how the agent is switched off | BTP team and Luis |
An AI go/no-go pack: the structure is familiar; the content is statistical.
Name residual risks in plain language. "In 600 runs the agent gave a wrong delivery date twice, both on partly delivered orders; users are told to check the date in the app before quoting it to a customer" is useful. "Some inaccuracy may occur" is not. NIST's Generative AI Profile (NIST AI 600-1, July 2024) offers a vocabulary for this: it lists risks such as confabulation, data privacy, information security and human-AI configuration, which is a helpful checklist for what the pack should address.
Monitoring after go-live
Testing before go-live estimates behavior; monitoring measures it. SAP says the new Joule Studio adds built-in observability and lifecycle management to track agent usage, costs and business impact over time, and its Preview page already shows traces of tool calls and reasoning steps during testing. Whatever the platform gives you, decide what Contoso watches and who acts on it.
- Day 1–14HypercareDaily review of a sample of conversations by Maria's team; every user-reported issue triaged within a day
- WeeklyQuality sample50 conversations scored with the evaluation rubric; escalation and refusal rates tracked
- MonthlyRe-evaluationFull evaluation set rerun against the baseline, even with no known change
- On triggerRegression runModel, platform, instruction, tool or grounding change: full set and safety suite
- QuarterlyReviewThresholds, scope, costs and residual risks reviewed with Maria, Dan and Nadia
Plan the switch-off before you need it. Know exactly how to stop the agent being invoked, for example by withdrawing the permissions users need to invoke it, who can do it at 02:00, and what users are told. Test that path in CMQ, the same way Contoso rehearses fallback for a cutover. And keep the business able to work without the agent: the Fiori apps it reads from still answer every question it answers.
One more consideration: regulation. Depending on what an agent does and where, AI-specific obligations can apply, for example under the EU AI Act for some HR uses. Contoso's order agent is a low-risk use, but the pack should record that someone checked. That assessment belongs to Nadia's GRC team and legal counsel, not to the test team; your job is to make sure the evidence they need exists.
What would you do?
Two days before go-live, the BTP team learns that SAP will update the model behind the agent the week after. All evidence is signed. Grace asks what to do.
- The AI evidence pack covers scope, versions, thresholds and results, safety, human checkpoints, residual risks, monitoring and rollback.
- Decide zero-tolerance first, then thresholds or an explicit, re-signed scope cut.
- Monitoring measures what testing estimated: sample reviews, monthly re-evaluation and trigger-driven regression.
- Rehearse the switch-off, and make sure the business can work without the agent.
Check your understanding · not graded
Lesson check
1. Which residual-risk statement belongs in an AI go/no-go pack?
2. What should be decided first in the go/no-go logic for an AI feature?
3. Why rerun the full evaluation set monthly even when no change is known?
4. Who should own the assessment of AI-specific regulatory obligations for an agent?