Name the problem
What is slow, expensive, error-prone, difficult to scale, or impossible today?
AI necessity · before assurance
Do you evenneed AI?
AI can be extraordinarily useful. That does not mean every workflow needs a model, every product needs a chatbot, or every lawn mower needs to develop opinions.
The principle: use AI when AI earns its place. If ordinary software solves the problem, that is a successful answer.
No AIOrdinary software can solve it
Process firstThe problem is not defined yet
Smaller AIKeep the useful part; remove the rest
AI justifiedNow the security question is real
Start upstream
“We want to use AI” is not a business requirement.
The technology comes after the problem. If the problem cannot be explained without using the word AI, the proposal is not ready to be evaluated.
Test ordinary software
Could a process change, query, rule, script, API, template, or scheduled job handle it?
Measure what AI adds
Identify the specific improvement that comes from probabilistic or generative capability.
Reduce the architecture
Use the least data, access, authority, autonomy, and persistence needed to get the benefit.
If you cannot explain the problem without using the word AI, you probably are not ready to propose AI as the solution.
Could normal software do this?
Not every alternative to AI is manual labor.
Conventional software is often faster to test, easier to reason about, cheaper to operate, and less surprising when the requirements are stable.
Sometimes your revolutionary autonomous agent is a cron job wearing a venture-capital hat.
Process changeDatabase querySearchRules engineScriptScheduled jobAPIWorkflow automationTemplateOrdinary software
What AI must add
Capability—not decoration.
AI earns its place when its incremental value is meaningful, measurable, and difficult to obtain with deterministic technology alone.
Unstructured inputsInterpret language, images, or messy information that cannot be captured reliably with fixed fields and rules.
Useful synthesisConnect and summarize large bodies of information where search alone leaves substantial human work.
Probabilistic judgmentClassify variable inputs where deterministic rules consistently perform poorly.
Novel generationCreate useful drafts, designs, explanations, or transformations that could not be pre-authored economically.
Adaptive reasoningHandle meaningful variation in inputs, constraints, or decision paths without enumerating every case.
Otherwise impracticalEnable a valuable capability that human processing or conventional software cannot deliver at the required scale.
Minimum useful AI
Use enough AI. Then stop.
Once AI survives the first test, the next design question is not how powerful the system can become. It is how little additional capability is required to obtain the benefit.
KeepThe useful capabilityThe smallest model behavior that changes the outcome
Less contextLess memoryLess identityLess dataFewer toolsLess authorityLess autonomyLess persistence
Basic security engineering
If you don’t need the port, don’t open the port.
You would not expose every service on every server to the public internet just because you could.
You should not add AI capabilities to every system just because models are available. Unnecessary capability is unnecessary attack surface.
The 60-second anti-funnel
Give the use case a chance to fail.
Seven short questions. Four defensible outcomes. No maturity score, no email gate, and no obligation for the answer to create a security engagement.
Start with the proposed use case—not the model.
Choose the closest answer each time. The result will explain which signals drove the conclusion.
Choose the closest answer to continue.
This is a decision aid, not a security assessment, ROI model, or certification.
Your result
Why this result
What to do next
Field notes
Test the framework against real use cases.
Each teardown starts with the problem, tests the deterministic alternative, identifies what AI adds, and ends with a verdict.
01 · Absurd on purpose
Does Your Lawn Mower Need AI?
A push mower probably does not need a chatbot. A robotic mower may have a more interesting case.
Verdict: it depends → 02 · Common business failureYour Workflow Doesn’t Need an Agent
When three rules and a webhook solve the job, autonomy is not innovation. It is extra surface.
Verdict: automation → 03 · A legitimate caseHere’s One That Actually Needs AI
A real example where unstructured information and adaptive reasoning materially change the solution.
Verdict: AI, kept small →Questions worth asking
About the check
AI adds system complexity, dependencies, and potential attack paths. Those costs can be justified when the capability creates enough value. They are unnecessary when it does not.
No. The check does not invent financial precision. It asks whether the AI creates a defensible, measurable improvement over ordinary software or process change.
No. It is an upstream decision aid. If AI is justified and the system has material access, authority, autonomy, or business consequence, independent assurance may be the next step.
No. The check runs locally in your browser. It does not require a signup and does not send your answers to LeftOut Security.
After the use case survives this test—especially when it needs sensitive data, integrations, tool access, external action, or becomes important to normal business operations.
Don’t expose a port you don’t need.
Don’t grant authority you don’t need.
Don’t collect data you don’t need.
Don’t deploy AI you don’t need.