Map the work from beginning to end
Choose a process with a clear start and finish. Map people, systems, information, decisions, handoffs, wait times, and exceptions. Include work outside formal systems, such as email follow-ups, spreadsheet updates, and manual copying.
Talk to the people who perform the process. Document what actually happens, not only what the procedure says. This can reveal hidden rework, duplicate entry, unclear ownership, and informal workarounds.
Establish a baseline
Measure volume, handling time, end-to-end cycle time, queue time, error rate, rework, handoffs, backlog, and service-level performance where relevant. Use a representative period and record how figures were collected. If data is incomplete, state the limitation instead of making unsupported benefit claims.
A baseline gives stakeholders a fair way to determine whether a pilot made a meaningful difference.
Score value and feasibility
- Frequency and volume: how often does the workflow occur?
- Manual effort: how much repetitive work or handoff is involved?
- Business impact: what improves if the process becomes faster or more consistent?
- Process stability: are steps understood, or does every case require unique judgment?
- Data readiness: are records accessible, accurate, and approved for use?
- Integration: can systems connect through supported interfaces?
- Risk and reversibility: what happens if an automated step is wrong?
- Measurement: can outcomes be verified against a baseline?
Choose the simplest suitable technology
Rules-based automation fits predictable processes with clear decision rules. APIs and integration are useful when systems are disconnected or data is repeatedly transferred. AI assistance can help with unstructured text, document understanding, classification, or summarization. Agentic workflows may fit goals requiring coordinated steps, contextual decisions, and controlled tool use.
A hybrid design is often practical: deterministic code handles permissions, validation, and transactions, while AI supports language-heavy or context-dependent tasks. The technology should follow the process and risk profile.
Pilot, measure, and decide
Define a limited scope and acceptance criteria before implementation. Test ordinary cases and exceptions, compare outcomes with the baseline, collect user feedback, and include the full operating cost: platform or model usage, integration, monitoring, support, and human review.
At the end, decide explicitly whether to expand, revise, keep the process manual, or stop. Choosing not to automate can be the right result when automation adds complexity without enough benefit. Souldigi’s proposed discovery approach maps the workflow, systems, data, and risks before recommending a pilot.
Sources and further reading
NIST SP 800-228, Guidelines for API Protection for Cloud-Native Systems: https://csrc.nist.gov/pubs/sp/800/228/upd1/final
NIST Cybersecurity Framework 2.0: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
