Skip to content

Command Palette

Search for a command to run...

90-day playbook

From first pilot to governed AI in 90 days

Three phases, each with actions and exit criteria. Treat the windows as a guide: finish a phase when its exit criteria are true, not when the calendar says so.

Last reviewed 2026-10-29.

The 90-day plan from foundation to production

Step 1 of 3

Foundation

Days 1 to 30. Stand up the gateway and a per-agent identity, then run one evaluated pilot against a human-only baseline. Name the owners for security and evaluation decisions.

Sequencing beats speed: each phase has to be solid before the next is safe. A plan, not a guarantee.

  1. Days 1 to 30

    Foundation

    Actions

    • Stand up an AI gateway as the single choke point for model calls
    • Establish a per-agent identity from day one, even for a single pilot
    • Pick one approved model for the pilot and keep the catalogue narrow for now
    • Set up request tracing and cost dashboards
    • Choose one well-scoped internal pilot with a clear owner and a measurable outcome
    • Build a reviewed evaluation set of 20 to 50 cases and measure a human-only baseline
    • Draft a data-classification policy and name owners for security and evaluation decisions

    Move on when

    • The gateway is live and is the only path to a model call
    • The pilot has its own agent identity, not a shared credential
    • A reviewed evaluation set of at least 20 cases and a human-only baseline exist
    • Basic tracing and cost dashboards exist
    • Named owners exist for security and evaluation decisions

  2. Days 31 to 60

    Controlled scale

    Actions

    • Add two to four use cases, favouring ones that reuse the pilot's sources and tools
    • Apply least-privilege credentials, a declarative policy and approval gates to any tool-using use case
    • Add an evaluation regression gate in CI for prompt, retrieval and model changes
    • Add a security scan for AI-generated code and tool-call authorisation
    • Start a red-team set for prompt injection and policy bypass, even a small one
    • Finalise the model catalogue and data-classification policy
    • Stand up a lightweight review checklist for new use cases and define and test the kill switch

    Move on when

    • Several use cases run in production, each with its own identity and evaluation set
    • A CI evaluation gate blocks regressions
    • A red-team set exists and runs regularly
    • The catalogue and data policy are final, not draft
    • The review checklist has been used at least once and the kill switch has been tested

  3. Days 61 to 90

    Production adoption

    Actions

    • Open the gateway, identity system and evaluation tooling to other teams as a documented platform
    • Track adoption and quality across the organisation, including gateway use and guardrail denial rates
    • Make the audit trail queryable by security and compliance without engineering involvement
    • Run a tabletop incident exercise with a plausible failure and address the gaps
    • Schedule a recurring maturity review, such as quarterly
    • Feed incidents and evaluation failures back into requirements and testing
    • Publish an internal reference architecture so new teams build on the same stack

    Move on when

    • The platform is documented and usable by teams outside the original pilot
    • The audit trail is queryable without engineering support
    • An incident exercise has been run and its gaps addressed
    • A recurring maturity review is scheduled
    • New use cases go through the review checklist by default

Use it with the other tools

Track adoption with the AI adoption funnel, justify spend with the business case builder, and read the full 90-day enterprise adoption playbook.

Open the checklist →