ICMD AI Coworker Leadership Operating System — 90-Day Rollout Checklist

Goal
Introduce AI copilots/agents into core workflows without causing a quality, security, or culture failure. Use this as a leadership checklist across engineering, product, ops, and support.

PHASE 0 (Days 1–7): Set non-negotiables
1) Assign an executive sponsor (VP Eng/COO/Head of Support) and one program owner.
2) Choose only two pilot lanes: one technical, one customer/ops-facing.
 - Engineering example: test generation + low-risk refactors
 - Support example: ticket triage + draft replies (human approval required)
3) Write a one-page AI policy:
 - Allowed uses
 - Prohibited uses
 - Human sign-off required for: pricing changes, legal terms, security incident communications, account changes, and other high-risk actions

PHASE 1 (Days 8–30): Build ownership and auditability first
4) Create an Agent Register:
 - Agent name and purpose
 - Human owner (DRI) and backup owner
 - Allowed actions (allowlist), forbidden areas, escalation path
 - Approved data sources (e.g., KB/docs/selected CRM fields) and restricted data (especially sensitive or regulated data)
5) Define logging requirements:
 - Capture prompts, tool calls, outputs, approvals, and deployments
 - Set retention and access controls appropriate for your risk profile
6) Put spend controls in place:
 - Monthly AI spend cap per function
 - Unit metrics that match the workflow (examples: cost per resolved ticket, cost per PR drafted, cost per triage action)

PHASE 2 (Days 31–60): Add gates and evaluation
7) Define acceptance tests per lane:
 - Engineering: tests pass, lint/static analysis, dependency scanning, CODEOWNERS approval
 - Support: policy compliance, correct routing, safe language, clear escalation triggers
8) Build a golden set for evaluation (use real, representative examples).
9) Set an error budget and a rollback rule:
 - Define what counts as a violation (policy breach, bad routing, unsafe suggestion, regression)
 - Define the action when you exceed the threshold (reduce autonomy, require approvals, pause the lane)

PHASE 3 (Days 61–90): Increase autonomy in steps
10) Use an autonomy ladder:
 - Draft only → open PR/ticket → request review → limited merge → limited runbook execution
11) Create an agent incident process:
 - Any agent-caused regression, policy issue, or customer escalation triggers a postmortem
 - Track root causes: missing constraint, missing eval case, missing permission boundary, missing human checkpoint
12) Update performance and culture norms:
 - Evaluate “quality and judgment,” not just volume
 - Normalize disclosure: mark relevant work as AI-assisted

Ongoing (Monthly/Quarterly): Governance
13) Quarterly permission review per agent (tighten scope; remove unused powers).
14) Monthly metrics review:
 - Throughput, defect trends, incident trends, escalation rate/CSAT impact, spend vs. cap
15) Vendor risk review:
 - Portability of prompts/policies/eval sets
 - Exit plan if pricing, terms, or product direction changes

Definition of Done
- Every agent has a human DRI, explicit permissions, audit logs, evaluation coverage, and a spend cap.
- Quality holds or improves (defects, incidents, escalations).
- Teams move faster without losing trust in reviews or customer outcomes.