A focused intake for the moment when an employee-built AI app moves toward real users. Make the exposure visible, then leave a brief someone can act on.
Use the controls to model one proposal. The score is a transparent local heuristic, not a security certification.
The default data value is two and access value two. Missing policy adds three, missing human review adds three, and missing logging adds two. Two plus two plus three plus three plus two equals twelve, or sixty percent of the twenty point display scale. Marking all three controls present removes eight points, leaving four or twenty percent. Bars share thirty pixels per score point. These are manually declared controls and an uncalibrated local review heuristic, not actual inspection or security certification. The source assigns Low priority below seven, Review before pilot from seven through twelve, and High priority at thirteen or higher. Bars compare twelve and thirteen at thirty pixels per point. The maximum reachable inputs are data five, access five and missing controls eight, totaling eighteen. Although the bar denominator and clamp are twenty, the actual controls cannot reach twenty. Its eighteen maximum is ninety percent of the displayed scale. These thresholds do not measure attack probability or compliance. Policy removes three points, human review three and logging two when checked. Equal units of sixty pixels per point show one hundred eighty, one hundred eighty and one hundred twenty pixels. They also remove their respective missing control actions. Broad access can still request a restricted pilot even when all three boxes are checked. At the lowest exposures with all controls present, the only next action is document evidence and schedule review. Checking boxes records assertions; it verifies no implemented control or security outcome.