Choose a First AI Workflow

Updated October 7, 2026

Which AI task should a Sarasota-area business test first?

Start with work you repeat and a result someone can check. A service business might sort requests for staff to review or draft replies from approved facts. These are possible tests. Keep these jobs with the person who decides them now: sending messages, quoting prices, promising dates, and changing customer records.

Start with the work, not the model

NIST is a US government agency that publishes standards and guides. On 26 January 2023, it published the AI Risk Management Framework 1.0. This voluntary guide can be used for many kinds of work. It helps you ask better questions. It is not a certificate or a required checklist. Start with the step that needs help. Then decide if AI has a job to do. Read the NIST guide.

Before a test, write down five things:

What starts the task.
What counts as finished.
What information it may use.
What a correct result looks like.
Who handles unusual cases.

Record how you do the job now. Compare the test with that process. A quick answer does not mean the whole job is faster.

Limit data and permissions

List what the workflow reads and every place it could send, edit, or delete something. NIST calls the rule least privilege: give a person or tool only the access and resources it needs for the task. If it only drafts replies, let it read customer records without changing them. A person must send the reply. Read NIST's definition.

Check the provider, account, feature, endpoint, and agreement before using business or customer data. The endpoint is the part of the service your software connects to. An API lets software send requests to a service. As checked on 7 October 2026, OpenAI says API content is not used to train its models unless the customer chooses to allow it. A model is the program that produces AI answers. Abuse monitoring logs may contain customer content. OpenAI keeps those logs for up to 30 days by default. OpenAI may keep logs longer if the law requires it. It may also keep them longer if reasonably needed to protect its services or another party from harm. Some features save data to do their job. How long it stays depends on the endpoint. These are OpenAI API terms. They are not a promise about another provider or every product feature. Read OpenAI's data rules.

Keep a person responsible

The reviewer needs three things:

A way to see where an answer came from.
The power to reject it.
Time to check it.

Decide who handles a wrong answer, an unusual request, or a service going down. NIST says to define, check, and record how people oversee AI. Oversight means watching and checking the work. Read NIST's item on human oversight (Map 3.5).

On 26 July 2024, NIST published its Generative AI Profile. It covers AI that makes new text, images, or other content. It names risks in how people and AI work together. One area is human-AI configuration: how work is split between a person and the tool. One is automation bias: trusting an answer just because a tool gave it. A review button does not protect anyone if the person is expected to approve work without checking it. Read NIST's Generative AI Profile.

Test the work you can judge

Use a small set of examples the business has permission to use. Include normal requests, missing details, odd wording, old information, and cases a person should handle. Write down what a good answer must contain before the test. Compare correct answers, fixes, unusual cases, and staff time with your current process. A few examples can show gaps. They do not prove readiness for real use or a customer result.

If the task touches a customer or business record, start with a staff-only test or a shadow test. A shadow test lets AI prepare a result while your current process stays in charge. Grow the test only after the owner checks the results and decides the errors fit the risk of this task. Stop if it uses data outside its limits, acts without approval, or gives a result no one can check.

Keep a way back

Before you connect it, write down:

Who can pause it.
How to remove access.
How staff can return to the current process.

Keep a short incident note. This records the error, the work affected, and what you did to recover. NIST says plans for checking a system after launch should include ways to challenge or override results. They should also cover retiring the system, handling problems, recovery, and changes. Your way back may be a task done by hand. The team needs to know when and how to use it. Read NIST's Manage section.

Use the software that already fits

NIST's Playbook, a companion guide of suggested actions, says AI may not be the right answer for a task. It says to weigh the risks against the benefits. If a form, spreadsheet, scheduling tool, or CRM rule already fits, keep it. CRM means software that helps manage customer records and contacts. If the process keeps changing, settle it before adding a system. If one tool can do the job, setup and training may be enough. Connected steps may need workflow engineering. Custom software should meet a need that your current tools cannot. Read NIST's Manage Playbook.

Sources

These primary sources support the guidance above. I checked the links on October 7, 2026. NIST describes AI RMF 1.0 as voluntary guidance and says it is being revised. OpenAI's data rules apply to its API, and retention can vary by feature and endpoint.

NIST AI Risk Management Framework 1.0, published January 26, 2023.
NIST Generative AI Profile, published July 26, 2024.
NIST definition of least privilege.
NIST AI RMF Core, human oversight.
NIST AI RMF Playbook, Manage.
OpenAI API data controls, checked October 7, 2026.

This is general guidance. It is not a client case study or a certificate that proves you meet rules. Faith is part of Lighthouse Agentic's identity. You do not have to share it to work with us. Bring one task worth testing and a few approved examples to a talk about fit.