Chapter 9.4 · Using AI for TPM Work With Verification, Privacy, and Accountability

Mission

By the end of this chapter, you can delegate a TPM task to AI with approved data, bounded authority, claim-specific verification, an auditable record, and named human accountability.

Measurable outcome: Classify a TPM task for AI assistance, define allowed data and authority, produce a verification plan, and retain a named human accountable for the final artifact or action; score at least 3 of 4.
Prerequisites: Chapters 18–20, 24, 28, and 33–35.
Work product: An AI Work Delegation and Verification Card.
Time: 65–90 minutes.

Before you read: Predict → Commit → Connect

An AI assistant reads meeting transcripts, tickets, and design documents and drafts Meridian Pay’s executive status. It marks the program green and says rollback was rehearsed. The transcript actually says a rehearsal is scheduled next week.

Predict the failure class and the human control that should catch it. Commit before reading. Connect to Chapter 24: an executive update is a decision instrument; polished language does not reduce the author’s accountability.

Delegate work, never accountability by accident

AI can help a TPM summarize, classify, compare, draft, translate, retrieve, simulate questions, generate candidate risks, and check consistency. It can also omit qualifiers, merge conflicting sources, expose restricted data, follow malicious instructions in documents, invent evidence, or create false confidence through fluent prose.

Use a task-level delegation decision:

Purpose: What work product and decision will this support?
Data: What information is permitted, necessary, and appropriately handled?
Authority: May the system only suggest, may it write a draft, or may it execute a bounded action?
Error consequence: What happens if content is wrong, incomplete, biased, late, or disclosed?
Verification: Which sources, calculations, owners, and samples will a human check?
Record: What prompt/context, model/tool/version, source links, reviewer, and approval must be retained?
Fallback: How will the work continue if the AI is unavailable or untrusted?

flowchart TD TASK["TPM task and decision consequence"] --> DATA{"Data allowed and necessary?"} DATA -- "No" --> MANUAL["Use approved non-AI path"] DATA -- "Yes" --> IMPACT{"Could error create material harm or commitment?"} IMPACT -- "Low" --> ASSIST["AI assist plus sampled review"] IMPACT -- "High" --> DRAFT["AI draft only; authoritative human verification"] DRAFT --> APPROVE["Named owner approves and signs"] ASSIST --> RECORD["Record sources, limits, and reviewer"] APPROVE --> RECORD

High impact does not always prohibit AI use; it increases required evidence, independence, and authority. Some uses should remain prohibited under local policy, law, contract, or ethical duty. The TPM should not paste data into an unapproved service merely because the output is “only a draft.”

Verification must match the failure mode

“Human reviewed” is vague. Define verification:

Factual claims: open the cited authoritative source and confirm qualifier, scope, date, and version.
Program status: reconcile milestones, risks, decisions, and owner statements against systems of record; do not let generated text become its own source.
Numbers: recompute from source data or an independently controlled calculation.
Summaries: sample against the transcript and specifically search for negation, uncertainty, dissent, decisions, and unassigned actions.
Technical content: route to the actual technical owner; TPM review cannot certify architecture or security.
Recommendations: test alternatives, assumptions, affected stakeholders, failure modes, and decision rights.
Sensitive output: scan for unintended personal, confidential, security, or contractual information.

Use source-grounded generation where available, but citations can still be wrong or irrelevant. Trace claim to source and source to current system state.

flowchart LR SRC["Approved source systems"] --> AI["AI draft or analysis"] AI --> CLAIM["Claims, numbers, risks, and actions"] CLAIM --> CHECK["Human verification by failure mode"] CHECK --> OWNER["Authoritative owners confirm material items"] OWNER --> FINAL["Accountable human publishes or decides"] FINAL --> FEED["Corrections, incidents, and process improvement"] FEED --> CHECK

For the Meridian update, the TPM must verify launch evidence against the Launch Evidence Matrix and rollback owner. The AI’s grammar is irrelevant to readiness truth.

Privacy, confidentiality, and instruction boundaries

Data minimization applies to AI assistance. Use the least data needed, approved tools, correct tenant, retention controls, access controls, and contractual terms. Remove or tokenize sensitive data where the task permits. Understand whether prompts/outputs are retained, used for service improvement, visible to administrators, or sent across regions.

Treat documents, web pages, tickets, and email as untrusted content. An AI assistant with connectors can encounter indirect prompt injection telling it to reveal secrets, change priorities, or invoke tools. Separate retrieval from authority; limit connectors and tool permissions; require confirmation for external communication or state-changing actions; monitor unusual access and output.

Do not use AI-generated personality judgments, employee rankings, medical inference, or hidden surveillance as a shortcut for stakeholder understanding. The manuscript’s human-accountability principle matters here: people are not rows to be psychometrically guessed from messages.

Use AI to widen thought, then narrow with evidence

High-value patterns include:

ask for missing assumptions and counterarguments;
generate a pre-mortem, then validate risks with owners;
compare two plans against explicit criteria;
turn notes into candidate decisions/actions, then confirm them;
produce audience-specific drafts from one verified fact set;
rehearse executive, engineering, security, or customer questions;
identify inconsistencies across controlled artifacts;
generate test cases that specialists review.

Avoid outsourcing judgment by asking “What should we do?” with no context or criteria. Provide decision frame, constraints, evidence, and authority; require alternatives and uncertainty. The final recommendation should remain explainable without appealing to the model.

Decision rights: Who owns what?

The information/data owner determines whether source material may be processed and under what controls.
Security, Privacy, Legal, Compliance, and Procurement define approved tooling and obligations.
Artifact owners remain accountable for accuracy and use: Engineering for technical claims, Finance for financial data, Legal for legal conclusions, and so on.
The decision authority owns the resulting program decision.
The TPM designs the AI-assisted workflow, minimizes data, preserves sources, coordinates verification, exposes limitations, and signs only claims they are authorized to make.
The AI system owns nothing. It has capabilities and recorded operations, not organizational accountability.

I do

I change the Meridian workflow. The assistant may draft from approved sources, but each status sentence carries a source pointer. The readiness section is generated only from the controlled evidence matrix. Red/yellow/green is computed from explicit criteria and remains a recommendation until I review exceptions with owners. External send requires my confirmation.

We do

An AI risk scan identifies “Security review may delay launch” from an old ticket. The current security owner says review finished yesterday but has not updated the ticket. Together decide what enters the status and RAID log.

Show the model answer

Model answer

Do not copy either claim blindly. Ask the security owner for the completion artifact and any residual findings. Update the system of record, then close or convert the risk based on evidence. The executive update can say “Security review completed on [date]; [finding/exception] remains” with a link. Record the AI flag as a useful discrepancy signal, not as authoritative program state.

Rubric (0–4)

0: Trusts the AI or verbal correction automatically.
1: Removes the risk without updating evidence.
2: Confirms with owner but leaves systems inconsistent.
3: Verifies the artifact, updates the record, and reports the qualified state.
4: Also fixes source freshness, records the discrepancy, and samples for similar stale items.

You do

Choose one task: status drafting, meeting recap, risk discovery, dependency comparison, or executive rehearsal. Complete an AI Work Delegation and Verification Card:

Field	Entry
Purpose and downstream decision
Approved input sources/data classification
Prohibited data or use
AI authority: suggest/draft/execute
Likely failure modes and consequence
Verification by claim type
Required owner confirmations
Record/version/retention
Final accountable human
Fallback and incident path

Run the workflow once. Record at least one correction, omission, or unsupported claim. If you find none, deliberately test negation, stale source, conflicting owner statements, and indirect instruction.

Pause & Recall

Recall the seven delegation questions. From Chapter 24, what makes an executive update decision-grade? From Chapter 28, what makes an approved tool insufficient without data-purpose controls? From Chapter 35, how can a retrieved document alter behavior?

Production lens

Maintain an approved-use inventory with tool, model, connectors, data classes, owners, and review dates. Monitor external sends and state-changing actions. Preserve a non-AI operating path for critical cadences. Review model/vendor changes. Treat recurrent correction patterns as workflow defects, not individual reviewer failure.

Workplace artifact: AI-assisted artifact disclosure

AI assisted with [task] using [approved sources/tool/version if required]. It was not authorized to [actions]. Human verification covered [facts/numbers/technical owners/sensitive content]. Material limitations are [limits]. [Named role] owns the final artifact and decision. Supporting sources: [links].

Chapter compression

AI can accelerate TPM drafts and analysis, but fluency is not evidence. Decide task, data, authority, consequence, verification, record, and fallback. Match review to the failure mode, confirm material claims with authoritative owners, protect data, limit tools, and keep one named human accountable.

Retrieval deck

Q: What are the seven delegation questions? A: Purpose, data, authority, error consequence, verification, record, and fallback.
Q: Why is a citation not proof? A: It may be irrelevant, outdated, fabricated, or disconnected from current system state.
Q: Who owns an AI-assisted status? A: The named human artifact owner and the authoritative owners of included claims, not the AI.
Q: What is the safe role of AI in risk discovery? A: Generate candidates and discrepancies for owner verification, not authoritative risks by itself.
Q: How does indirect prompt injection reach a TPM assistant? A: Through retrieved documents, tickets, email, pages, or tool output interpreted as instruction.

Spaced review

Now: Classify one TPM task by purpose, data, authority, consequence, and accountable human.
+1 day: Recreate the seven delegation questions from memory.
+3 days: Verify one generated claim, number, and owner statement against sources.
+7 days: Audit a complete AI-assisted artifact claim-to-source.
+14 days: Review correction patterns and change the workflow, source, or authority boundary.

Using AI for TPM Work With Verification, Privacy, and Accountability